@einsia/agent-git@0.2.19: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@einsia/agent-git@0.2.19: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

40"postinstall": "node npm/postinstall.js", "check-version": "node scripts/check-version.js", "bump-version": "node scripts/bump-version.mjs",

Medium

Suspicious Lifecycle Evidence

package.json automatically invokes npm/postinstall.js after installation.

package.jsonView on unpkg · L40

npm/postinstall.jsView file

72if (truthy(process.env.AGIT_SKIP_SETUP)) return; const setup = spawnSync(bin, ['setup'], { stdio: 'inherit', env }); if (setup.status !== 0) { log.

Medium

Suspicious Lifecycle Evidence

The install hook runs the resolved binary's setup command unless AGIT_SKIP_SETUP is enabled.

npm/postinstall.jsView on unpkg · L72

npm/lib/resolve.jsView file

32const key = platform.packageKey(); if (!key) return null; const name = path.join(platform.packageName(key), 'bin', platform.binaryName()).replace(/\\/g, '/'); // Resolve by walking node_modules up from the package root; that matches // where npm installs the optional dep. try { return require.resolve(name, { paths: [pkgRoot] }); } catch { return null; } } module.exp

Medium

Suspicious Dependency Evidence

The normal executable is resolved from a platform dependency; its setup implementation is absent from this snapshot.

npm/lib/resolve.jsView on unpkg · L32

npm/lib/reconcile-worker.jsView file

33if (!global) process.exit(0); spawnSync(bin, ['rc', 'local', 'reconcile-installed', '--allow-other-installation'], { stdio: 'ignore', timeout: 35000, env: { ...process.env, AGIT_INSTALL_CHANNEL: 'npm_global' }, windowsHide: true, });

Medium

Ai Review Evidence

CLI daemon reconciliation is restricted to a verified global installation.

npm/lib/reconcile-worker.jsView on unpkg · L33

Source & flagged code

6 flagged

package.jsonView file

Lines 20-59json

20 "homepage": "https://agent-git.com",

21 "repository": {

22 "type": "git",

23 "url": "git+https://github.com/Einsia/agent-git.git"

24 },

25 "bugs": {

26 "url": "https://github.com/Einsia/agent-git/issues"

27 },

28 "bin": {

29 "agit": "npm/shim.js"

30 },

31 "files": [

32 "npm/shim.js",

33 "npm/postinstall.js",

34 "npm/lib/",

35 "npm/README.md",

36 "README.md",

37 "CHANGELOG.md"

38 ],

39 "scripts": {

40 "postinstall": "node npm/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "check-version": "node scripts/check-version.js",

42 "bump-version": "node scripts/bump-version.mjs",

43 "prepack": "node scripts/check-version.js"

Medium

Suspicious Lifecycle Evidence

package.json automatically invokes npm/postinstall.js after installation.

package.jsonView on unpkg · L40

44 },

45 "engines": {

46 "node": ">=20"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "optionalDependencies": {

52 "@einsia/agent-git-linux-x64": "0.2.19",

53 "@einsia/agent-git-linux-arm64": "0.2.19",

54 "@einsia/agent-git-darwin-x64": "0.2.19",

55 "@einsia/agent-git-darwin-arm64": "0.2.19",

56 "@einsia/agent-git-win32-x64": "0.2.19"

57 }

58}

59

npm/postinstall.jsView file

Lines 52-80javascript

52 stdio: ['ignore', 'inherit', 'inherit'],

53 env: { ...process.env, AGIT_INSTALL_CHANNEL: 'npm_global' },

54 });

55 }

56 if (

npm/lib/resolve.jsView file

Lines 12-45javascript

12// 1. An explicit AGIT_BINARY override — the user is pointing the way and gets

13// the last word.

14// 2. This package's bin/<agit> — placed by hand outside the publish flow (a

15// build a volunteer is testing, for example).

16// 3. The platform subpackage's package/bin/<agit> — the normal path.

17//

18// A require that resolves nothing means npm skipped the optional dep for this

19// platform (an unsupported system).

20function resolveBinary(pkgRoot

npm/lib/reconcile-worker.jsView file

Lines 13-41javascript

13let global = false;

14try {

15 const installed = fs.realpathSync(pkgRoot);

16 const same =