Loading npm security reports…

@dyzsasd/dev-loop@1.0.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @dyzsasd/dev-loop / 1.0.0

@dyzsasd/dev-loop@1.0.0

An autonomous dev team in a folder — nine agents (PM, QA, senior/junior Dev, Sweep, Reflect, Ops, Architect, Communication) coordinating through ticket state on Linear or a bundled zero-dep local hub (node:sqlite + web UI). 1.0 team/workspace model: one d

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 530 KB of source, external domains: 127.0.0.1, api.linear.app, github.com, open.feishu.cn, slack.com, www.apple.com

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "author": {

30 "name": "Shuai"

31 },

32 "bin": {

33 "dev-loop": "dist/cli.js",

34 "dev-loop-hub": "dist/server.js"

35 },

36 "files": [

37 "dist/",

38 ".claude-plugin/",

39 "skills/",

40 "references/",

41 "hooks/",

42 "config/",

43 "postinstall.cjs",

44 "README.md"

45 ],

46 "scripts": {

47 "build": "rm -rf dist .claude-plugin skills references hooks config && tsc -p tsconfig.build.json && chmod +x dist/cli.js dist/server.js && cp -R ../.claude-plugin ../skills ../references ../hooks ../config ./",

48 "prepack": "npm run build",

49 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "typecheck": "tsc -p tsconfig.check.json",

51 "start": "DEVLOOP_CREATE_PROJECT=1 node src/server.ts",

52 "daemon": "node src/daemon.ts",

53 "seed": "node src/seed.ts",

54 "init-service": "node src/init-service.ts",

55 "init-service-test": "node test/init-service.ts",

56 "seed-test": "node test/seed.ts",

57 "mcp-merge": "node src/mcp-merge.ts",

58 "mcp-merge-test": "node test/mcp-merge.ts",

59 "release-version": "node src/release-version.ts",

60 "doctor": "node src/server.ts doctor",

61 "identity-check": "node src/server.ts identity-check",

62 "run-agents-test": "node test/run-agents.ts",

63 "team-config": "node test/team-config.ts",

64 "workspace": "node test/workspace.ts",

65 "team-cli": "node test/team-cli.ts",

66 "rotation": "node test/rotation.ts",

67 "team-scheduler": "node test/team-scheduler.ts",

68 "lessons": "node test/lessons.ts",

69 "comms": "node test/comms.ts",

dist/node-runtime.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/node-runtime.jsView on unpkg · L1

3import { delimiter, join } from "node:path";

4export

dist/daemon-lifecycle.jsView file

Lines 1-31javascript

1// dev-loop hub daemon — the per-project process-lifecycle / supervisor subsystem (DL-74 extraction).

2//

3// DL-41: idempotent per-project daemon lifecycle (up | ensure | down | status). A thin, additive wrapper

4// around the foreground boot that lives in `daemon.ts` (this module's sibling): `up` resolves the project

5// (cwd or DEVLOOP_PROJECT), picks a fixed-default localhost port, and spawns `daemon.ts` detached so the web UI

6// survives the launching shell; `down`/`status` operate on a machine-local runfile. Designed so the DL-42

7// SessionStart hook can call `up` unconditionally: a non-service / unresolved project is a clean no-op +

8// exit 0, and a second `up` never double-starts. The foreground boot path (`npm run daemon`) is NOT touched

9// by any of this — daemon.ts's own top-level dispatch routes a lifecycle subcommand here before its

dist/init-service.jsView file

Lines 60-100javascript

60 const { key, name, prefix, dbPath } = opts;

61 const here = dirname(fileURLToPath(import.meta.url));

Source & flagged code

6 flagged · loading source

package.jsonView file

Source & flagged code

6 flagged

package.jsonView file

Lines 29-69json

29 "author": {

30 "name": "Shuai"

31 },

32 "bin": {

33 "dev-loop": "dist/cli.js",

34 "dev-loop-hub": "dist/server.js"

35 },

36 "files": [

37 "dist/",

38 ".claude-plugin/",

39 "skills/",

40 "references/",

41 "hooks/",

42 "config/",

43 "postinstall.cjs",

44 "README.md"

45 ],

46 "scripts": {

48 "prepack": "npm run build",

49 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "typecheck": "tsc -p tsconfig.check.json",

51 "start": "DEVLOOP_CREATE_PROJECT=1 node src/server.ts",

52 "daemon": "node src/daemon.ts",

53 "seed": "node src/seed.ts",

54 "init-service": "node src/init-service.ts",

55 "init-service-test": "node test/init-service.ts",

56 "seed-test": "node test/seed.ts",

57 "mcp-merge": "node src/mcp-merge.ts",

58 "mcp-merge-test": "node test/mcp-merge.ts",

59 "release-version": "node src/release-version.ts",

60 "doctor": "node src/server.ts doctor",

61 "identity-check": "node src/server.ts identity-check",

62 "run-agents-test": "node test/run-agents.ts",

63 "team-config": "node test/team-config.ts",

64 "workspace": "node test/workspace.ts",

65 "team-cli": "node test/team-cli.ts",

66 "rotation": "node test/rotation.ts",

67 "team-scheduler": "node test/team-scheduler.ts",

68 "lessons": "node test/lessons.ts",

69 "comms": "node test/comms.ts",

dist/node-runtime.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/node-runtime.jsView on unpkg · L1

3import { delimiter, join } from "node:path";

4export

dist/daemon-lifecycle.jsView file

Lines 1-31javascript

1// dev-loop hub daemon — the per-project process-lifecycle / supervisor subsystem (DL-74 extraction).

2//

3// DL-41: idempotent per-project daemon lifecycle (up | ensure | down | status). A thin, additive wrapper

4// around the foreground boot that lives in `daemon.ts` (this module's sibling): `up` resolves the project

5// (cwd or DEVLOOP_PROJECT), picks a fixed-default localhost port, and spawns `daemon.ts` detached so the web UI

6// survives the launching shell; `down`/`status` operate on a machine-local runfile. Designed so the DL-42

7// SessionStart hook can call `up` unconditionally: a non-service / unresolved project is a clean no-op +

8// exit 0, and a second `up` never double-starts. The foreground boot path (`npm run daemon`) is NOT touched

9// by any of this — daemon.ts's own top-level dispatch routes a lifecycle subcommand here before its

dist/init-service.jsView file

Lines 60-100javascript

60 const { key, name, prefix, dbPath } = opts;

61 const here = dirname(fileURLToPath(import.meta.url));

Lines 125-165javascript

125 log(`✅ .mcp.json ${m.action}: dev-loop-hub registered in ${join(repoPath, ".mcp.json")} (servers: ${m.servers.join(", ")})`);

126 else

127 log(`⚠️ .mcp.json registration skipped: ${m.error}\n register dev-loop-hub by hand from config/mcp.example.json, then re-run.`);

128 }

129 // ── (d) doctor → assert DOCTOR_OK ──

130 if (dryRun) {

131 log(`[dry-run] would: run doctor on ${dbPath} and assert DOCTOR_OK`);

132 }

133 else if (!(await runDoctor(dbPath))) {

134 log("❌ doctor did not report DOCTOR_OK — the SoR is not healthy; not starting the daemon");

135 return 1;

136 }

137 else {

138 log("✅ doctor: DOCTOR_OK");

139 }

140 // ── (e) one-shot `daemon up` (DL-41) → confirm `/api/health {ok:true}` → report the board URL ──

141 let boardUrl = null;

142 if (dryRun) {

143 log(`[dry-run] would: start the daemon once (${serverEntry} daemon up) and confirm /api/health {ok:true}, then report the board URL`);

144 }

145 else {

146 const r = spawnSync(process.execPath, [serverEntry, "daemon", "up"], {

147 encoding: "utf8",

148 env: { ...process.env, DEVLOOP_HUB_DB: dbPath, DEVLOOP_PROJECT: key, DEVLOOP_ACTOR: "operator" },

149 });

150 if (r.status !== 0) {

151 log(`❌ daemon up failed (exit ${r.status})${r.stderr ? "\n " + r.stderr.trim() : ""}`);

152 return 1;

153 }

154 const out = (r.stdout ?? "").trim();

155 if (out)

156 log(out.split("\n").map((l) => " " + l).join("\n"));

157 // Confirm health + learn the URL from the runfile the lifecycle just wrote (runDir mirrors lcRunDir).

158 const runDir = process.env.DEVLOOP_RUN_DIR ?? dirname(dbPath);

159 try {

160 const run = JSON.parse(readFileSync(join(runDir, `daemon-${key}.json`), "utf8"));

161 const h = (await fetch(`${run.url}/api/health`).then((x) => x.json()).catch(() => null));

162 if (!h || h.ok !== true) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/init-service.jsView on unpkg · L145

163 log(`❌ daemon started but /api/health is not ok at ${run.url}`);

164 return 1;

165 }

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code