@duckcodeailabs/dql-cli@1.7.1: Suspicious npm security report

Loading npm security reports…

@duckcodeailabs/dql-cli@1.7.1: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged

dist/local-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @duckcodeailabs/dql-cli@1.7.0 matchedIdentity = npm:QGR1Y2tjb2RlYWlsYWJzL2RxbC1jbGk:1.7.0 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1060if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1061: const parameterized = parameterizeSqlForDqlImport(originalSql); L1062: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1060

1import { execFileSync, execSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; L3: import { createServer } from "node:http"; L4: import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, watch, writeFileSync, } from "node:fs"; ... L53: try { L54: const parsed = JSON.parse(readFileSync(manifestPath, 'utf-8')); L55: if (parsed.semantic_models && typeof parsed.semantic_models === 'object') ... L375: export async function startLocalServer(opts) { L376: const { rootDir, executor, connection: rawConnection, preferredPort, projectRoot = process.cwd() } = opts; L377: const bindHost = opts.host ?? process.env.DQL_HOST ?? '127.0.0.1'; L378: const loopback = bindHost === '127.0.0.1' || bindHost === 'localhost' || bindHost === '::1'; ... L3010: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

Lines 13-53javascript

13 return process.env.DQL_LLM_KEY;

14 const credPath = join(homedir(), '.dql', 'credentials');

15 if (!existsSync

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView file

•path = dist/assets/dql-notebook/assets/index-4DbeLWHA.js kind = oversized_source_file sizeBytes = 4964833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1060if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1061: const parameterized = parameterizeSqlForDqlImport(originalSql); L1062: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1060

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

33package = @duckcodeailabs/dql-cli; repositoryIdentity = dql; dependency = @anthropic-ai/sdk L33: try { L34: const mod = (await import('@anthropic-ai/sdk')); L35: const Ctor = mod.default ?? mod.Anthropic;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/llm/providers/claude-agent-sdk.jsView on unpkg · L33

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView file

•path = dist/assets/dql-notebook/assets/index-4DbeLWHA.js kind = oversized_source_file sizeBytes = 4964833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView on unpkg

Source & flagged code

5 flagged

dist/local-runtime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/local-runtime.jsView on unpkg

1060if ((!artifact || artifact.kind === 'sql_block') && originalSql) { L1061: const parameterized = parameterizeSqlForDqlImport(originalSql); L1062: const artifactName = artifact?.name

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local-runtime.jsView on unpkg · L1060

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/local-runtime.jsView on unpkg · L1

dist/llm/providers/claude-agent-sdk.jsView file

Lines 13-53javascript

13 return process.env.DQL_LLM_KEY;

14 const credPath = join(homedir(), '.dql', 'credentials');

15 if (!existsSync

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView file

•path = dist/assets/dql-notebook/assets/index-4DbeLWHA.js kind = oversized_source_file sizeBytes = 4964833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/dql-notebook/assets/index-4DbeLWHA.jsView on unpkg

@duckcodeailabs/dql-cli@1.7.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code