@earthsense/siracmd@0.1.59: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@earthsense/siracmd@0.1.59: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/auth.jsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...1U";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...1U";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

145// Cross-platform browser opener L146: const { exec } = await import("child_process"); L147: return (url) => new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L145

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @earthsense/siracmd@0.1.55 matchedIdentity = npm:QGVhcnRoc2Vuc2Uvc2lyYWNtZA:0.1.55 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1962const t = setTimeout(() => ctrl.abort(), 1500); L1963: fetch(`http://localhost:${port}/`, { signal: ctrl.signal, method: "HEAD" }) L1964: .then((r) => { clearTimeout(t); resolve(r.ok || r.status < 500); }) ... L1971: console.log(`→ spawning siracmd serve-data --port ${port} (detached)`); L1972: const { spawn } = await import("child_process"); L1973: const { mkdirSync, openSync } = await import("fs"); L1974: const home = process.env.HOME || "/tmp"; L1975: const logPath = `${home}/.sira/serve-data.log`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1962

2831try { L2832: execSync(sshCmd("which claude"), { stdio: "ignore" }); L2833: console.log("Claude Code already installed."); ... L2843: fi && \ L2844: echo '${password}' | sudo -S npm install -g @anthropic-ai/claude-code L2845: `));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2831

dist/auth.d.tsView file

9patternName = supabase_service_key severity = critical line = 9 matchedText = declare ...1U";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.d.ts

dist/auth.d.tsView on unpkg · L9

Source & flagged code

7 flagged

dist/auth.jsView file

Lines 1-33javascript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8import { createServer } from "http";

9import { createClient } from "@supabase/supabase-js";

10import { loadCliConfig, saveCliConfig } from "./config.js";

11// Hardcoded Supabase project — all siracmd instances connect to the same project

12const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co";

13const SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InRudGpiZGhydmljZXNpZnV4dW5jIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMyNjQyMDgsImV4cCI6MjA4ODg0MDIwOH0.Jqpv0508USVVyLfmvFUr931yAm8mBxb4Jn6fWFtF41U";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

14const CALLBACK_PORT = 54321;

15const REDIRECT_URL = `http://localhost:${CALLBACK_PORT}/auth/callback`;

16export { SUPABASE_URL, SUPABASE_ANON_KEY };

17export async function login(provider = "github") {

18 const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

19 // Get the OAuth URL from Supabase

20 const { data, error } = await client.auth.signInWithOAuth({

21 provider,

22 options: { redirectTo: REDIRECT_URL, skipBrowserRedirect: true },

23 });

24 if (error || !data?.url) {

25 throw new Error(`Failed to initiate OAuth: ${error?.message ?? "no URL returned"}`);

26 }

27 console.log(`\nOpening browser for ${provider} authentication...`);

28 console.log(`If it doesn't open, visit:\n ${data.url}\n`);

29 // Open browser

30 const open = await getOpen();

31 await open(data.url);

32 // Wait for callback

33 const params = await waitForCallback();

Lines 125-156javascript

125 res.end("<html><body><h2>Authenticated! You can close this tab.</h2></body></html>");

126 clearTimeout(timeout);

127 server.close();

128 resolve(params);

129 }

130 else {

131 res.writeHead(404

dist/index.jsView file

Lines 1942-1982javascript

1942 console.log(`✓ collection already local at ${outDir} — skipping pull`);

1943 }

1944 else {

1945 if (existsSync(outDir) && readdirSync(outDir).length >

dist/auth.d.tsView file

Lines 1-16typescript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8declare const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co"

Lines 2811-2851javascript

2811 catch {

2812 console.error("sshpass is not installed. Install it with:\n macOS: brew install hudochenkov/sshpass/sshpass\n Linux: sudo apt install sshpass");

2813 process.exit(1);

2814 }

2815 const localClaude = pjoin(hd(), ".claude");

2816 const localClaudeJson = pjoin(hd(), ".claude.json");

2817 if (!existsSync(localClaude)) {

2818 console.error(`Local Claude config not found at ${localClaude}`);

2819 console.error("Authenticate Claude Code on this machine first.");

2820 process.exit(1);

2821 }

2822 const sshOpts = "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";

2823 const remoteHome = `/home/${user}`;

2824 const sshCmd = (cmd) => `sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} ${JSON.stringify(cmd)}`;

2825 const run = (cmd) => {

2826 execSync(cmd, { stdio: "inherit" });

2827 };

2828 // --install: check if claude is on the remote, install if missing

2829 if (installClaude) {

2830 console.log(`Checking if Claude Code is installed on ${user}@${host}...`);

2831 try {

2832 execSync(sshCmd("which claude"), { stdio: "ignore" });

2833 console.log("Claude Code already installed.");

2834 }

2835 catch {

2836 console.log("Claude Code not found — installing Node.js and Claude Code...");

2837 run(sshCmd(`

2838 echo '${password}' | sudo -S apt-get update && \

2839 echo '${password}' | sudo -S apt-get install -y curl && \

2840 if ! command -v node > /dev/null 2>&1; then

2841 curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && \

2842 echo '${password}' | sudo -S apt-get install -y nodejs

2843 fi && \

2844 echo '${password}' | sudo -S npm install -g @anthropic-ai/claude-code

2845 `));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2831

2846 }

2847 }

2848 // Wipe existing .claude on remote for a clean copy

2849 console.log("Removing existing .claude on remote...");

2850 run(sshCmd(`rm -rf ${remoteHome}/.claude`));

2851 // Tar up local .claude (excluding bulky dirs) and pipe to remote