@crouton-kit/crouter@0.3.98: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@crouton-kit/crouter@0.3.98: Suspicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/clients/web/web-cmd.jsView file

12// single leaf: `crtr surface web serve`. L13: import { spawn } from 'node:child_process'; L14: import { defineBranch, defineLeaf } from '../../core/command.js';

High

Child Process

Package source references child process execution.

dist/clients/web/web-cmd.jsView on unpkg · L12

dist/clients/attach/slash-commands.jsView file

536/** Open `cmd` as a fire-and-forget tmux display-popup (same geometry as the canvas L537: * extensions). tmux runs the trailing string through `sh -c`; the popup owns its L538: * screen and closes itself when the command exits, dropping back to this pane. */

High

Shell

Package source references shell execution.

dist/clients/attach/slash-commands.jsView on unpkg · L536

bin/runtime-selector.mjsView file

90if (!runtime) return; L91: await import(pathToFileURL(runtime.entryPath).href); L92: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/runtime-selector.mjsView on unpkg · L90

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent"; L2: import { execFile } from "node:child_process"; L3: import { promisify } from "node:util"; ... L25: const h = createHash("sha1").update(cwd).digest("hex").slice(0, 16); L26: return join(homedir(), ".crouter", "cache", `crouter-help-${h}.json`); L27: } ... L38: try { L39: const c = JSON.parse(readFileSync(file, "utf8")) as { text?: string; at?: number }; L40: if (typeof c.text === "string" && c.text && typeof c.at === "number" && Date.now() - c.at < TTL_MS) { ... L49: try { L50: const { stdout } = await run("crouter", ["-h"], { timeout: 10_000 }); L51: helpText = stdout.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView on unpkg · L1

dist/core/self-update.jsView file

23export function selfUpdate() { L24: const res = spawnSync('npm', ['i', '-g', '@crouton-kit/crouter@latest'], { stdio: 'inherit' }); L25: if (res.status !== 0) { L26: throw general('npm install failed'); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/self-update.jsView on unpkg · L23

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View file

•path = dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2 kind = high_entropy_blob sizeBytes = 23556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View on unpkg

dist/clients/attach/attach-cmd.jsView file

•path = dist/clients/attach/attach-cmd.js kind = oversized_source_file sizeBytes = 7040045 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/clients/attach/attach-cmd.jsView on unpkg

dist/daemon/crtrd.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @crouton-kit/crouter@0.3.97 matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.97 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/crtrd.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 20-60json

20 },

21 "./web": {

22 "import": "./dist/web/index.js",

23 "types": "./dist/web/index.d.ts"

24 }

25 },

26 "files": [

27 "dist",

28 "bin",

29 "!bin/__tests__",

30 "docs",

31 "scripts/postinstall.mjs",

32 "scripts/install-runtime.mjs",

33 "scripts/runtime-lock.mjs",

34 "runtime.lock.json"

35 ],

36 "scripts": {

37 "build": "node scripts/build.mjs",

38 "test:build-output": "node scripts/build-concurrency-test.mjs",

39 "lint:web-px": "node scripts/lint-web-px.mjs",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "install-runtime": "node scripts/install-runtime.mjs",

42 "prepack": "node scripts/runtime-lock.mjs prepack",

43 "postpack": "node scripts/runtime-lock.mjs postpack",

44 "dev": "tsx src/cli.ts",

45 "link": "npm link",

46 "prepublishOnly": "npm run build",

47 "test": "node --import tsx/esm --test 'src/**/__tests__/*.test.ts'",

48 "test:full": "npm run test:full:cheap && npm run test:full:live && npm run test:full:heavy",

49 "test:full:cheap": "node --import tsx/esm --test-concurrency=4 --test $(find src -type f -name '*.test.ts' -path '*/__tests__/*' ! -path '*/__tests__/*/*' ! -path 'src/core/__tests__/live-mutation-verbs.test.ts')",

50 "test:full:live": "node --import tsx/esm --test-concurrency=1 --test src/core/__tests__/live-mutation-verbs.test.ts",

51 "test:full:heavy": "node --import tsx/esm --test-concurrency=1 --test 'src/core/__tests__/full/*.test.ts'"

52 },

53 "overrides": {

54 "@earendil-works/pi-ai": "0.80.6",

55 "@earendil-works/pi-agent-core": "0.80.6",

56 "@earendil-works/pi-tui": "0.80.6"

57 },

58 "repository": {

59 "type": "git",

60 "url": "git+https://github.com/vallum-security/crouter.git"

dist/clients/web/web-cmd.jsView file

Lines 1-32javascript

1// web-cmd.ts — the `crtr surface web` command leaf + registration.

2//

3// Starts the ONE long-running unified web server (server.ts): the crouter web UI

4// host. It serves the shell SPA, the source + command bridge (POST

5// /__crtr/source), the SSE change lane (GET /__crtr/events), and a VERBATIM

6// browser ⇄ broker relay on `ws://HOST:PORT/node/<id>` (the browser becomes

7// the SAME protocol peer as surface attach). The node is selected by the URL, so

8// there is NO positional node here.

9//

10// Command shape (plan §3.6): the CLI path-walker forbids a flat top-level leaf

dist/clients/attach/slash-commands.jsView file

Lines 516-556javascript

516 return true;

517}

518/** `/context`. Opens `crtr node inspect context` as a popup — a

519 * read-only nvim explorer over this node's + its subscriptions' context dirs.

520 * Self-contained popup — no node-focus, no return-pane. */

521function openContext(ctx) {

522 if

bin/runtime-selector.mjsView file

Lines 70-93javascript

70 return { ok: true, runtime: { manifest, entryPath } };

71 } catch (error) {

72 return failure(errorMessage(error));

73 }

74}

75

76/** Resolve a selected runtime without changing process state or writing output. */

dist/builtin-pi-packages/pi-crtr-extensions/extensions/crouter-help.tsView file

Lines 1-21typescript

1import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

2import { execFile } from "node:child_process";

3import { promisify } from "node:util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/self-update.jsView file

Lines 3-43javascript

3// (core) previously imported from commands/update.ts (commands layer).

4import { spawnSync } from 'node:child_process';

5import { fileURLToPath } from 'node:url';

6import { join, dirname } from 'node:path';

7import { readFileSync } from

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View file

•path = dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2 kind = high_entropy_blob sizeBytes = 23556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-client/assets/martian-mono-latin-wght-normal-5W32yIyr.woff2View on unpkg

dist/clients/attach/attach-cmd.jsView file

•path = dist/clients/attach/attach-cmd.js kind = oversized_source_file sizeBytes = 7040045 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/clients/attach/attach-cmd.jsView on unpkg

dist/daemon/crtrd.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @crouton-kit/crouter@0.3.97 matchedIdentity = npm:QGNyb3V0b24ta2l0L2Nyb3V0ZXI:0.3.97 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/crtrd.jsView on unpkg