@galda/cli@0.10.35: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@galda/cli@0.10.35: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/manager-for-ai.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @galda/cli@0.10.33 matchedIdentity = npm:QGdhbGRhL2NsaQ:0.10.33 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/manager-for-ai.mjsView on unpkg

8L9: import { spawnSync } from 'node:child_process'; L10: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/manager-for-ai.mjsView on unpkg · L8

8L9: import { spawnSync } from 'node:child_process'; L10: import { existsSync } from 'node:fs'; ... L12: import { fileURLToPath, pathToFileURL } from 'node:url'; L13: import { createServer } from 'node:net'; L14: import { isCommandOnPath, resolveConnectedAgents, resolveOpenBrowserDefault } from '../engine/lib.mjs'; ... L36: // resolution kicks in. On macOS/Linux keep shell off (no injection surface). L37: const WIN = process.platform === 'win32'; L38: const probe = (cmd, args) => spawnSync(cmd, args, { encoding: 'utf8', shell: WIN }); ... L47: const hasClaude = !claude.error && claude.status === 0; L48: const hasCodex = isCommandOnPath('codex', { pathEnv: process.env.PATH || '', sep: WIN ? ';' : ':', pathExt: WIN ? (process.env.PATHEXT || '') : '' }); L49: if (!hasClaude && !hasCodex)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/manager-for-ai.mjsView on unpkg · L8

8Cross-file remote execution chain: bin/manager-for-ai.mjs spawns engine/server.mjs; helper contains network access plus dynamic code execution. L8: L9: import { spawnSync } from 'node:child_process'; L10: import { existsSync } from 'node:fs'; ... L12: import { fileURLToPath, pathToFileURL } from 'node:url'; L13: import { createServer } from 'node:net'; L14: import { isCommandOnPath, resolveConnectedAgents, resolveOpenBrowserDefault } from '../engine/lib.mjs'; ... L36: // resolution kicks in. On macOS/Linux keep shell off (no injection surface). L37: const WIN = process.platform === 'win32'; L38: const probe = (cmd, args) => spawnSync(cmd, args, { encoding: 'utf8', shell: WIN }); ... L47: const hasClaude = !claude.error && claude.status === 0; L48: const hasCodex = isCommandOnPath('codex',

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/manager-for-ai.mjsView on unpkg · L8

111process.env.MANAGER_PORT = String(port); L112: await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href); L113:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/manager-for-ai.mjsView on unpkg · L111

engine/lib.mjsView file

2021contains invisible/control Unicode U+FEFF (zero width no-break space) const m = text.match(/^<U+FEFF>?---[ \t]*\r?\n([\s\S]*?)\r?\n---/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

engine/lib.mjsView on unpkg · L2021

•Trigger-reachable chain: manifest.bin -> bin/manager-for-ai.mjs -> engine/lib.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

engine/lib.mjsView on unpkg

Source & flagged code

7 flagged

bin/manager-for-ai.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Galda — one-line launcher

3//

4// npx @galda/cli

5//

6// Checks the environment, starts the local server, prints (and opens) the

7// keyed URL. State lives in ~/.manager-for-ai (never in the npx cache).

8

9import { spawnSync } from 'node:child_process';

10import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/manager-for-ai.mjsView on unpkg · L8

11import { join, resolve, dirname } from 'node:path';

12import { fileURLToPath, pathToFileURL } from 'node:url';

13import { createServer } from 'node:net';

14import { isCommandOnPath, resolveConnectedAgents, resolveOpenBrowserDefault } from '../engine/lib.mjs';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/manager-for-ai.mjsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/manager-for-ai.mjsView on unpkg · L8

15

16const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');

17const say = (m) => console.log(`[galda] ${m}`);

18

19// Pick a free local port (starting at the requested one) so `npx @galda/cli`

20// JUST WORKS even when the default 4400 is already taken — e.g. another manager

21// is running on this machine. We do it HERE, before importing the server and

22// spawning the relay-client, and export MANAGER_PORT, so both halves agree on

23// the same port (the relay-client reads MANAGER_PORT too). No manual override.

24const canBind = (p) => new Promise((res) => {

25 const s = createServer();

26 s.once('error', () => res(false));

27 s.once('listening', () => s.close(() => res(true)));

28 s.listen(p, '127.0.0.1');

Lines 91-131javascript

91// The license public key is already baked in engine/lib.mjs (offline verify).

92// Opt out with an empty value: `MANAGER_BILLING_API_URL= RELAY_URL= npx @galda/cli`.

93// Use the OWNED custom domain (galda.app), never the Cloudflare workers.dev

94// subdomain — that subdomain is named after an unrelated client (a2c-tech) and

95// must never appear in Galda's product. galda.app is bound to the same Worker

96// and serves the whole API (/connect, /checkout, /api/*). See [[no-a2c-tech]].

97process.env.MANAGER_BILLING_API_URL = process.env.MANAGER_BILLING_API_URL ?? 'https://galda.app';

98

•matchType = previous_version_dangerous_delta matchedPackage = @galda/cli@0.10.33 matchedIdentity = npm:QGdhbGRhL2NsaQ:0.10.33 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/manager-for-ai.mjsView on unpkg

engine/lib.mjsView file

Lines 2001-2041javascript

2001 'python', 'python3', 'pip', 'pip3', 'pytest', 'go', 'cargo', 'rustc',

2002 'ruby', 'bundle', 'make',

2003 // build/test/lint runners invoked directly