@getmikie/cli@1.1.106: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@getmikie/cli@1.1.106: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/reconcile-install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

14"scripts": { "postinstall": "node ./scripts/reconcile-install.mjs" }

Medium

Suspicious Lifecycle Evidence

The manifest runs a postinstall script automatically.

package.jsonView on unpkg · L14

scripts/reconcile-install.mjsView file

441/** Reconcile exact-owned client launchers once for this installed package. */ export async function reconcileInstalledClients({ environment = process.env, platform = process.platform, version, markerPath, resolveBinary = resolveNativeBinary, prepareLauncher = (binary) => prepareNativeLaunch(binary, ["setup", "codex"], { platform, version, environment }), retireLauncher = (launcher, runtimeSha256, preserveSha256) => retireHistoricalRuntimes(launcher, { expectedSha256: runtimeSha256, preserveSha256, }), commands = createCommandAdapter({ env…

Medium

Suspicious Lifecycle Evidence

Postinstall invokes a native runtime reconciliation that prepares a Codex setup command.

scripts/reconcile-install.mjsView on unpkg · L441

523const baseEnvironment = { MIKIE_DISTRIBUTION_MODE: "npm", MIKIE_NPM_UPDATE_TOPOLOGY: "npm_global", MIKIE_UPDATE_REPAIR_CANDIDATE: binary, MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher, }; const prepared = await commands.run(binary, CLIENT_REPAIR_ARGUMENTS, { shell: false, capture: true, environment: { ...baseEnvironment, MIKIE_NPM_UPDATE_REPAIR_PHASE: "prepare" }, }); const preparedReceipt = parseClientRepair(prepared); const settlementPhase = preparedReceipt.action === "refused" ? "rollback" : "commit"; const committed = await commands.run(b…

Medium

Ai Review Evidence

The automatic flow invokes a native Claude-hook repair command; that native behavior is not available for source inspection.

scripts/reconcile-install.mjsView on unpkg · L523

194const pathApi = platform === "win32" ? path.win32 : path.posix; const profileIdentity = pathIdentity(profileRoot, platform); const codexIdentity = pathIdentity( environment.CODEX_HOME ?? pathApi.join(profileRoot, ".codex"), platform, ); if (codexIdentity === null || !/^[0-9a-f]{64}$/.test(runtimeSha256)) { throw new Error("installed client reconciliation profile authority is unavailable"); } return { schema_version: CLIENT_RECONCILIATION_SCHEMA,

Medium

Stripped Provenance Metadata

The reconciliation records the active Codex home in its authority marker.

scripts/reconcile-install.mjsView on unpkg · L194

Lines 503-543javascript

503 pathIdentity(launcher, platform) !== pathIdentity(expectedLauncher, platform) ||

504 (await sha256File(binary)) !== initialRuntimeSha256 ||

505 (await sha256File(launcher)) !== initialRuntimeSha256

506 ) {

507 throw new Error("materialized Mikie runtime does not match its reconciliation marker");

508 }

509 }

510 if (!(await readClientMarker(scopedMarker, authority))) {

511 throw new Error("installed client reconciliation marker changed during runtime recovery");

512 }

513 const preserved = explicitMarker

514 ? [authority.runtime_sha256]

515 : await retainedRuntimeDigests(markerRoot, platform);

516 await retireLauncher(launcher, authority.runtime_sha256, preserved);

517 return { status: "current" };

518 }

519 const finalLauncher = await prepareLauncher(binary);

520 if (![binary, finalLauncher].every((value) => typeof value === "string" && path.isAbsolute(value))) {

521 throw new Error("installed client reconciliation authority is invalid");

522 }

523 const baseEnvironment = {

524 MIKIE_DISTRIBUTION_MODE: "npm",

525 MIKIE_NPM_UPDATE_TOPOLOGY: "npm_global",

526 MIKIE_UPDATE_REPAIR_CANDIDATE: binary,

527 MIKIE_UPDATE_REPAIR_LAUNCHER: finalLauncher,

528 };

529 const prepared = await commands.run(binary, CLIENT_REPAIR_ARGUMENTS, {

530 shell: false,

531 capture: true,

532 environment: { ...baseEnvironment, MIKIE_NPM_UPDATE_REPAIR_PHASE: "prepare" },

533 });

534 const preparedReceipt = parseClientRepair(prepared);

Medium

Ai Review Evidence

The automatic flow invokes a native Claude-hook repair command; that native behavior is not available for source inspection.

scripts/reconcile-install.mjsView on unpkg · L523

535 const settlementPhase = preparedReceipt.action === "refused" ? "rollback" : "commit";

536 const committed = await commands.run(binary, CLIENT_REPAIR_ARGUMENTS, {

537 shell: false,

538 capture: true,

539 environment: { ...baseEnvironment, MIKIE_NPM_UPDATE_REPAIR_PHASE: settlementPhase },

540 });

541 parseClientSettlement(committed, settlementPhase);

542 if (preparedReceipt.action === "refused") {

543 if (preparedReceipt.before === "unavailable") {