@earthsense/siracmd@0.1.64: Suspicious npm security report (Warn)

Loading npm security reports…

@earthsense/siracmd@0.1.64: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

dist/auth.jsView file

Lines 1-33javascript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8import { createServer } from "http";

9import { createClient } from "@supabase/supabase-js";

10import { loadCliConfig, saveCliConfig } from "./config.js";

11// Hardcoded Supabase project — all siracmd instances connect to the same project

12const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co";

13const SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InRudGpiZGhydmljZXNpZnV4dW5jIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMyNjQyMDgsImV4cCI6MjA4ODg0MDIwOH0.Jqpv0508USVVyLfmvFUr931yAm8mBxb4Jn6fWFtF41U";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

14const CALLBACK_PORT = 54321;

15const REDIRECT_URL = `http://localhost:${CALLBACK_PORT}/auth/callback`;

16export { SUPABASE_URL, SUPABASE_ANON_KEY };

17export async function login(provider = "github") {

18 const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

19 // Get the OAuth URL from Supabase

20 const { data, error } = await client.auth.signInWithOAuth({

21 provider,

22 options: { redirectTo: REDIRECT_URL, skipBrowserRedirect: true },

23 });

24 if (error || !data?.url) {

25 throw new Error(`Failed to initiate OAuth: ${error?.message ?? "no URL returned"}`);

26 }

27 console.log(`\nOpening browser for ${provider} authentication...`);

28 console.log(`If it doesn't open, visit:\n ${data.url}\n`);

29 // Open browser

30 const open = await getOpen();

31 await open(data.url);

32 // Wait for callback

33 const params = await waitForCallback();

Lines 125-156javascript

125 res.end("<html><body><h2>Authenticated! You can close this tab.</h2></body></html>");

126 clearTimeout(timeout);

127 server.close();

128 resolve(params);

129 }

130 else {

131 res.writeHead(404

dist/index.jsView file

Lines 2000-2040javascript

2000 console.log(`✓ collection already local at ${outDir} — skipping pull`);

2001 }

2002 else {

2003 if (existsSync(outDir) && readdirSync(outDir).length >

dist/auth.d.tsView file

Lines 1-16typescript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8declare const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co"

Source & flagged code

8 flagged · loading source

dist/auth.jsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...1U";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...1U";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

145// Cross-platform browser opener L146: const { exec } = await import("child_process"); L147: return (url) => new Promise((resolve) => {

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L145

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @earthsense/siracmd@0.1.59 matchedIdentity = npm:QGVhcnRoc2Vuc2Uvc2lyYWNtZA:0.1.59 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

3144`"echo ${JSON.stringify(password)} | sudo -S hostnamectl set-hostname ${JSON.stringify(machineName)} 2>/dev/null || ` + L3145: `echo ${JSON.stringify(password)} | sudo -S sh -c 'echo ${JSON.stringify(machineName)} > /etc/hostname' 2>/dev/null || true"`); L3146: console.log(` Hostname set to "${machineName}".`);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3144

2020const t = setTimeout(() => ctrl.abort(), 1500); L2021: fetch(`http://localhost:${port}/`, { signal: ctrl.signal, method: "HEAD" }) L2022: .then((r) => { clearTimeout(t); resolve(r.ok || r.status < 500); }) ... L2029: console.log(`→ spawning siracmd serve-data --port ${port} (detached)`); L2030: const { spawn } = await import("child_process"); L2031: const { mkdirSync, openSync } = await import("fs"); L2032: const home = process.env.HOME || "/tmp"; L2033: const logPath = `${home}/.sira/serve-data.log`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2020

2889try { L2890: execSync(sshCmd("which claude"), { stdio: "ignore" }); L2891: console.log("Claude Code already installed."); ... L2901: fi && \ L2902: echo '${password}' | sudo -S npm install -g @anthropic-ai/claude-code L2903: `));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2889

dist/auth.d.tsView file

9patternName = supabase_service_key severity = critical line = 9 matchedText = declare ...1U";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.d.ts

dist/auth.d.tsView on unpkg · L9

Source & flagged code

8 flagged

dist/auth.jsView file

Lines 1-33javascript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8import { createServer } from "http";

9import { createClient } from "@supabase/supabase-js";

10import { loadCliConfig, saveCliConfig } from "./config.js";

11// Hardcoded Supabase project — all siracmd instances connect to the same project

12const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/auth.jsView on unpkg · L13

Critical

Secret Pattern

Supabase service role key (JWT) in dist/auth.js

dist/auth.jsView on unpkg · L13

14const CALLBACK_PORT = 54321;

15const REDIRECT_URL = `http://localhost:${CALLBACK_PORT}/auth/callback`;

16export { SUPABASE_URL, SUPABASE_ANON_KEY };

17export async function login(provider = "github") {

18 const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

19 // Get the OAuth URL from Supabase

20 const { data, error } = await client.auth.signInWithOAuth({

21 provider,

22 options: { redirectTo: REDIRECT_URL, skipBrowserRedirect: true },

23 });

24 if (error || !data?.url) {

25 throw new Error(`Failed to initiate OAuth: ${error?.message ?? "no URL returned"}`);

26 }

27 console.log(`\nOpening browser for ${provider} authentication...`);

28 console.log(`If it doesn't open, visit:\n ${data.url}\n`);

29 // Open browser

30 const open = await getOpen();

31 await open(data.url);

32 // Wait for callback

33 const params = await waitForCallback();

Lines 125-156javascript

125 res.end("<html><body><h2>Authenticated! You can close this tab.</h2></body></html>");

126 clearTimeout(timeout);

127 server.close();

128 resolve(params);

129 }

130 else {

131 res.writeHead(404

dist/index.jsView file

Lines 2000-2040javascript

2000 console.log(`✓ collection already local at ${outDir} — skipping pull`);

2001 }

2002 else {

2003 if (existsSync(outDir) && readdirSync(outDir).length >

dist/auth.d.tsView file

Lines 1-16typescript

1/**

2 * Browser-based OAuth login for siracmd.

3 *

4 * Opens a browser to the Supabase OAuth flow (GitHub/Google),

5 * runs a local HTTP server to receive the callback, and stores

6 * the session in ~/.sira/cli-config.json.

7 */

8declare const SUPABASE_URL = "https://tntjbdhrvicesifuxunc.supabase.co"

Lines 2869-2909javascript

2869 catch {

2870 console.error("sshpass is not installed. Install it with:\n macOS: brew install hudochenkov/sshpass/sshpass\n Linux: sudo apt install sshpass");

2871 process.exit(1);

2872 }

2873 const localClaude = pjoin(hd(), ".claude");

2874 const localClaudeJson = pjoin(hd(), ".claude.json");

2875 if (!existsSync(localClaude)) {

2876 console.error(`Local Claude config not found at ${localClaude}`);

2877 console.error("Authenticate Claude Code on this machine first.");

2878 process.exit(1);

2879 }

2880 const sshOpts = "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";

2881 const remoteHome = `/home/${user}`;

2882 const sshCmd = (cmd) => `sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} ${JSON.stringify(cmd)}`;

2883 const run = (cmd) => {

2884 execSync(cmd, { stdio: "inherit" });

2885 };

2886 // --install: check if claude is on the remote, install if missing

2887 if (installClaude) {

2888 console.log(`Checking if Claude Code is installed on ${user}@${host}...`);

2889 try {

2890 execSync(sshCmd("which claude"), { stdio: "ignore" });

2891 console.log("Claude Code already installed.");

2892 }

2893 catch {

2894 console.log("Claude Code not found — installing Node.js and Claude Code...");

2895 run(sshCmd(`

2896 echo '${password}' | sudo -S apt-get update && \

2897 echo '${password}' | sudo -S apt-get install -y curl && \

2898 if ! command -v node > /dev/null 2>&1; then

2899 curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && \

2900 echo '${password}' | sudo -S apt-get install -y nodejs

2901 fi && \

2902 echo '${password}' | sudo -S npm install -g @anthropic-ai/claude-code

2903 `));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2889

2904 }

2905 }

2906 // Wipe existing .claude on remote for a clean copy

2907 console.log("Removing existing .claude on remote...");

2908 run(sshCmd(`rm -rf ${remoteHome}/.claude`));

2909 // Tar up local .claude (excluding bulky dirs) and pipe to remote

Lines 3124-3164javascript

3124 wfs(tmpCfg, siraConfig);

3125 try {

3126 execSync(`sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} "mkdir -p ~/.sira"`, { stdio: "inherit" });

3127 execSync(`sshpass -p ${JSON.stringify(password)} scp ${sshOpts} -P ${port} ${tmpCfg} ${user}@${host}:~/.sira/config.json`, { stdio: "inherit" });

3128 }

3129 finally {

3130 try {

3131 uls(tmpCfg);

3132 }

3133 catch { }

3134 }

3135 console.log(" Supabase adapter configured.");

3136 }

3137 catch (e) {

3138 console.error(` Warning: could not write config: ${e.message}`);

3139 }

3140 // Set the machine hostname on the remote

3141 console.log(`\nSetting machine hostname to "${machineName}" on ${user}@${host}...`);

3142 try {

3143 run(`sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} ` +

3144 `"echo ${JSON.stringify(password)} | sudo -S hostnamectl set-hostname ${JSON.stringify(machineName)} 2>/dev/null || ` +

3145 `echo ${JSON.stringify(password)} | sudo -S sh -c 'echo ${JSON.stringify(machineName)} > /etc/hostname' 2>/dev/null || true"`);

3146 console.log(` Hostname set to "${machineName}".`);

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3144

3147 }

3148 catch {

3149 console.warn(` Warning: could not set hostname. You may need to set it manually.`);

3150 }

3151 // Enable systemd service (auto-starts and survives reboots)

3152 console.log(`\nEnabling SIRA daemon service on ${user}@${host}...`);

3153 try {

3154 run(`sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} "sira daemon enable"`);

3155 }

3156 catch {

3157 // systemd user sessions may not be available — fall back to manual start

3158 console.log(" systemd service not available — starting daemon directly...");

3159 try {

3160 run(`sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} ` +

3161 `"nohup sira daemon start > /tmp/sira-daemon.log 2>&1 &"`);

3162 execSync("sleep 2");

3163 const status = execSync(`sshpass -p ${JSON.stringify(password)} ssh ${sshOpts} -p ${port} ${user}@${host} "sira daemon status 2>/dev/null"`, { encoding: "utf-8", timeout: 10_000 }).trim();

3164 console.log(` ${status}`);

@earthsense/siracmd@0.1.64

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code