@duckcodeailabs/dql-cli@1.6.29: Suspicious npm security report

Loading npm security reports…

@duckcodeailabs/dql-cli@1.6.29: Suspicious npm security report | LPM Firewall

Source & flagged code

4 flagged

dist/block-studio-import.jsView file

Lines 27-67javascript

27 }));

28 const manifest = {

29 id: importId,

30 sourceKind,

31 inputPath: sourceBundle.inputPath,

32 inputMode,

33 sourceFiles: sourceBundle.sources.map((source) => source.path),

34 createdAt: now,

35 updatedAt: now,

36 defaults,

37 candidateIds: candidates.map((candidate) => candidate.id),

38 };

39 const session = { ...manifest, candidates };

40 writeBlockStudioImportSession(projectRoot, session);

41 return session;

42}

43export function loadBlockStudioImportSession(projectRoot, importId) {

44 const root = importRoot(projectRoot, importId);

45 const manifestPath = join(root, 'manifest.json');

46 if (!existsSync(manifestPath))

47 throw new Error(`Import session not found: ${importId}`);

48 const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));

49 const candidates = manifest.candidateIds.map((candidateId) => readBlockStudioImportCandidate(projectRoot, importId, candidateId));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/block-studio-import.jsView on unpkg · L47

50 return { ...manifest, candidates };

51}

52export function listBlockStudioImportSessions(projectRoot) {

53 const root = join(projectRoot, '.dql', 'imports');

54 if (!existsSync(root))

55 return [];

56 const summaries = [];

57 for (const entry of readdirSync(root, { withFileTypes: true })) {

58 if (!entry.isDirectory())

59 continue;

60 try {

61 const session = loadBlockStudioImportSession(projectRoot, entry.name);

62 summaries.push({

63 id: session.id,

64 sourceKind: session.sourceKind,

65 inputMode: session.inputMode ?? 'path',

66 inputPath: session.inputPath,

67 sourceFiles: session.sourceFiles ?? [],

dist/llm/providers/claude-agent-sdk.jsView file

Lines 12-52javascript

12 return process.env.DQL_LLM_KEY;

13 const credPath = join(homedir(), '.dql', 'credentials');

14 if (!existsSync

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView file

•path = dist/assets/dql-notebook/assets/index-QJKCrLXe.js kind = oversized_source_file sizeBytes = 4488336 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView on unpkg

dist/local-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @duckcodeailabs/dql-cli@1.6.27 matchedIdentity = npm:QGR1Y2tjb2RlYWlsYWJzL2RxbC1jbGk:1.6.27 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/block-studio-import.jsView file

47throw new Error(`Import session not found: ${importId}`); L48: const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8')); L49: const candidates = manifest.candidateIds.map((candidateId) => readBlockStudioImportCandidate(projectRoot, importId, candidateId));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/block-studio-import.jsView on unpkg · L47

dist/llm/providers/claude-agent-sdk.jsView file

32package = @duckcodeailabs/dql-cli; repositoryIdentity = dql; dependency = @anthropic-ai/sdk L32: try { L33: const mod = (await import('@anthropic-ai/sdk')); L34: const Ctor = mod.default ?? mod.Anthropic;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/llm/providers/claude-agent-sdk.jsView on unpkg · L32

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView file

•path = dist/assets/dql-notebook/assets/index-QJKCrLXe.js kind = oversized_source_file sizeBytes = 4488336 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView on unpkg

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

Source & flagged code

4 flagged

dist/block-studio-import.jsView file

Lines 27-67javascript

27 }));

28 const manifest = {

29 id: importId,

30 sourceKind,

31 inputPath: sourceBundle.inputPath,

32 inputMode,

33 sourceFiles: sourceBundle.sources.map((source) => source.path),

34 createdAt: now,

35 updatedAt: now,

36 defaults,

37 candidateIds: candidates.map((candidate) => candidate.id),

38 };

39 const session = { ...manifest, candidates };

40 writeBlockStudioImportSession(projectRoot, session);

41 return session;

42}

43export function loadBlockStudioImportSession(projectRoot, importId) {

44 const root = importRoot(projectRoot, importId);

45 const manifestPath = join(root, 'manifest.json');

46 if (!existsSync(manifestPath))

47 throw new Error(`Import session not found: ${importId}`);

48 const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));

49 const candidates = manifest.candidateIds.map((candidateId) => readBlockStudioImportCandidate(projectRoot, importId, candidateId));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/block-studio-import.jsView on unpkg · L47

50 return { ...manifest, candidates };

51}

52export function listBlockStudioImportSessions(projectRoot) {

53 const root = join(projectRoot, '.dql', 'imports');

54 if (!existsSync(root))

55 return [];

56 const summaries = [];

57 for (const entry of readdirSync(root, { withFileTypes: true })) {

58 if (!entry.isDirectory())

59 continue;

60 try {

61 const session = loadBlockStudioImportSession(projectRoot, entry.name);

62 summaries.push({

63 id: session.id,

64 sourceKind: session.sourceKind,

65 inputMode: session.inputMode ?? 'path',

66 inputPath: session.inputPath,

67 sourceFiles: session.sourceFiles ?? [],

dist/llm/providers/claude-agent-sdk.jsView file

Lines 12-52javascript

12 return process.env.DQL_LLM_KEY;

13 const credPath = join(homedir(), '.dql', 'credentials');

14 if (!existsSync

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView file

•path = dist/assets/dql-notebook/assets/index-QJKCrLXe.js kind = oversized_source_file sizeBytes = 4488336 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-QJKCrLXe.jsView on unpkg

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

@duckcodeailabs/dql-cli@1.6.29

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code