@duckcodeailabs/dql-cli@1.7.0: Suspicious npm security report

Loading npm security reports…

@duckcodeailabs/dql-cli@1.7.0: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged

dist/local-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @duckcodeailabs/dql-cli@1.6.31 matchedIdentity = npm:QGR1Y2tjb2RlYWlsYWJzL2RxbC1jbGk:1.6.31 similarity = 0.681 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1039if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1040: const parameterized = parameterizeSqlForDqlImport(originalSql); L1041: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1039

1import { execFileSync, execSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; L3: import { createServer } from "node:http"; L4: import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, watch, writeFileSync, } from "node:fs"; ... L53: try { L54: const parsed = JSON.parse(readFileSync(manifestPath, 'utf-8')); L55: if (parsed.semantic_models && typeof parsed.semantic_models === 'object') ... L375: export async function startLocalServer(opts) { L376: const { rootDir, executor, connection: rawConnection, preferredPort, projectRoot = process.cwd() } = opts; L377: const bindHost = opts.host ?? process.env.DQL_HOST ?? '127.0.0.1'; L378: const loopback = bindHost === '127.0.0.1' || bindHost === 'localhost' || bindHost === '::1'; ... L2986: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

Lines 13-53javascript

13 return process.env.DQL_LLM_KEY;

14 const credPath = join(homedir(), '.dql', 'credentials');

15 if (!existsSync

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView file

•path = dist/assets/dql-notebook/assets/index-2Tszpipm.js kind = oversized_source_file sizeBytes = 4956146 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1039if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1040: const parameterized = parameterizeSqlForDqlImport(originalSql); L1041: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1039

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

33package = @duckcodeailabs/dql-cli; repositoryIdentity = dql; dependency = @anthropic-ai/sdk L33: try { L34: const mod = (await import('@anthropic-ai/sdk')); L35: const Ctor = mod.default ?? mod.Anthropic;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/llm/providers/claude-agent-sdk.jsView on unpkg · L33

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView file

•path = dist/assets/dql-notebook/assets/index-2Tszpipm.js kind = oversized_source_file sizeBytes = 4956146 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView on unpkg

Source & flagged code

5 flagged

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1039if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1040: const parameterized = parameterizeSqlForDqlImport(originalSql); L1041: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1039

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

Lines 13-53javascript

13 return process.env.DQL_LLM_KEY;

14 const credPath = join(homedir(), '.dql', 'credentials');

15 if (!existsSync

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView file

•path = dist/assets/dql-notebook/assets/index-2Tszpipm.js kind = oversized_source_file sizeBytes = 4956146 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-2Tszpipm.jsView on unpkg

@duckcodeailabs/dql-cli@1.7.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code