@f5-sales-demo/xcsh@19.63.6: Suspicious npm security report

Loading npm security reports…

@f5-sales-demo/xcsh@19.63.6: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged

src/tools/python.tsView file

Lines 558-598typescript

558 timeout?: number;

559}

560

561/** Format a status event as a single line for display. */

562function formatStatusEvent(event: PythonStatusEvent, theme: Theme, width: number): string {

563 const { op, ...data } = event;

564

565 // Map operations to available theme icons

566 type AvailableIcon = "icon.file" | "icon.folder" | "icon.git" | "icon.package";

567 const opIcons: Record<string, AvailableIcon> = {

568 // File I/O

569 read: "icon.file",

570 write: "icon.file",

571 append: "icon.file",

572 cat: "icon.file",

573 touch: "icon.file",

574 lines: "icon.file",

575 // Navigation/Directory

576 ls: "icon.folder",

577 cd: "icon.folder",

578 pwd: "icon.folder",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/tools/python.tsView on unpkg · L578

579 mkdir: "icon.folder",

580 tree: "icon.folder",

581 stat: "icon.folder",

582 // Search (use file icon since no search icon)

583 find: "icon.file",

584 grep: "icon.file",

585 rgrep: "icon.file",

586 glob: "icon.file",

587 // Edit operations (use file icon)

588 replace: "icon.file",

589 sed: "icon.file",

590 rsed: "icon.file",

591 delete_lines: "icon.file",

592 delete_matching: "icon.file",

593 insert_at: "icon.file",

594 // Git

595 git_status: "icon.git",

596 git_diff: "icon.git",

597 git_log: "icon.git",

598 git_show: "icon.git",

src/tools/browser.tsView file

Lines 1164-1204typescript

1164 const endX = toBox.x + toBox.width / 2;

1165 const endY = toBox.y + toBox.height / 2;

src/tools/xcsh-api.tsView file

Lines 17-57typescript

17 if (namespaceName === "default") return "default";

18 if (namespaceName.startsWith("ves-io-")) return "system";

19 return "custom"

src/utils/shell-snapshot.tsView file

Lines 1-24typescript

1/**

2 * Shell environment snapshot for preserving user aliases, functions, and options.

3 *

4 * Creates a snapshot file that captures the user's shell environment from their

5 * .bashrc/.zshrc, which can be sourced before each command to provide a familiar

6 * shell experience.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

7 */

8import

src/stt/setup.tsView file

Lines 1-23typescript

1import { detectRecordingTools } from "./recorder";

2import { resolvePython } from "./transcriber";

4const isWindows = process.platform === "win32";

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

Source & flagged code

7 flagged · loading source

src/tools/python.tsView file

578patternName = generic_password severity = medium line = 578 matchedText = pwd: "...

Medium

Secret Pattern

Package contains a possible secret pattern.

src/tools/python.tsView on unpkg · L578

src/tools/browser.tsView file

1184try { L1185: return await new Function(`return (async () => (${source}))();`)(); L1186: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/tools/browser.tsView on unpkg · L1184

src/tools/xcsh-api.tsView file

37try { L38: const mod = require("../internal-urls/api-spec-index.generated") as { L39: API_SPEC_DATA?: Readonly<

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/xcsh-api.tsView on unpkg · L37

src/utils/shell-snapshot.tsView file

4* Creates a snapshot file that captures the user's shell environment from their L5: * .bashrc/.zshrc, which can be sourced before each command to provide a familiar L6: * shell experience. ... L26: function getShellConfigFile(shell: string): string { L27: const home = os.homedir(); L28: if (shell.includes("zsh")) return path.join(home, ".zshrc"); ... L52: typeset -f > /dev/null 2>&1 L53: # Get user function names - filter system/private ones L54: typeset +f 2>/dev/null | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do ... L61: declare -f > /dev/null 2>&1 L62: # Get user function names - filter system/private ones, use base64 for special chars L63: declare -F 2>/dev/null | cut -d' ' -f3 | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

src/stt/setup.tsView file

3L4: const isWindows = process.platform === "win32"; L5: ... L14: const recorderHint = isWindows L15: ? "PowerShell fallback available. For better quality: install SoX or FFmpeg." L16: : "Install SoX: sudo apt install sox, or FFmpeg: sudo apt install ffmpeg"; ... L18: const pythonCmd = resolvePython(); L19: const pythonHint = "Install Python 3.8+ from https://python.org"; L20: ... L23: const check = Bun.spawnSync([pythonCmd, "-c", "import whisper"], { L24: stdout: "pipe", L25: stderr: "pipe",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/stt/setup.tsView on unpkg · L3

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

Source & flagged code

7 flagged

src/tools/python.tsView file

Lines 558-598typescript

558 timeout?: number;

559}

560

561/** Format a status event as a single line for display. */

562function formatStatusEvent(event: PythonStatusEvent, theme: Theme, width: number): string {

563 const { op, ...data } = event;

564

565 // Map operations to available theme icons

566 type AvailableIcon = "icon.file" | "icon.folder" | "icon.git" | "icon.package";

567 const opIcons: Record<string, AvailableIcon> = {

568 // File I/O

569 read: "icon.file",

570 write: "icon.file",

571 append: "icon.file",

572 cat: "icon.file",

573 touch: "icon.file",

574 lines: "icon.file",

575 // Navigation/Directory

576 ls: "icon.folder",

577 cd: "icon.folder",

578 pwd: "icon.folder",

Medium

Secret Pattern

Package contains a possible secret pattern.

src/tools/python.tsView on unpkg · L578

579 mkdir: "icon.folder",

580 tree: "icon.folder",

581 stat: "icon.folder",

582 // Search (use file icon since no search icon)

583 find: "icon.file",

584 grep: "icon.file",

585 rgrep: "icon.file",

586 glob: "icon.file",

587 // Edit operations (use file icon)

588 replace: "icon.file",

589 sed: "icon.file",

590 rsed: "icon.file",

591 delete_lines: "icon.file",

592 delete_matching: "icon.file",

593 insert_at: "icon.file",

594 // Git

595 git_status: "icon.git",

596 git_diff: "icon.git",

597 git_log: "icon.git",

598 git_show: "icon.git",

src/tools/browser.tsView file

Lines 1164-1204typescript

1164 const endX = toBox.x + toBox.width / 2;

1165 const endY = toBox.y + toBox.height / 2;

src/tools/xcsh-api.tsView file

Lines 17-57typescript

17 if (namespaceName === "default") return "default";

18 if (namespaceName.startsWith("ves-io-")) return "system";

19 return "custom"

src/utils/shell-snapshot.tsView file

Lines 1-24typescript

1/**

2 * Shell environment snapshot for preserving user aliases, functions, and options.

3 *

4 * Creates a snapshot file that captures the user's shell environment from their

5 * .bashrc/.zshrc, which can be sourced before each command to provide a familiar

6 * shell experience.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

7 */

8import

src/stt/setup.tsView file

Lines 1-23typescript

1import { detectRecordingTools } from "./recorder";

2import { resolvePython } from "./transcriber";

4const isWindows = process.platform === "win32";

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

@f5-sales-demo/xcsh@19.63.6

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code