@getmikie/cli@1.1.119: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@getmikie/cli@1.1.119: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/reconcile-install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

14"scripts": { "postinstall": "node ./scripts/reconcile-install.mjs" }

Medium

Suspicious Lifecycle Evidence

The package automatically runs a postinstall script.

package.jsonView on unpkg · L14

lib/launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/launcher.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/launcher.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 56afec83ce73bd5e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/launcher.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/launcher.mjsView on unpkg

lib/update.mjsView file

•matchType = normalized_sha256 matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/update.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/update.mjsView on unpkg

scripts/reconcile-install.mjsView file

•matchType = normalized_sha256 matchedPackage = @getmikie/cli@1.1.118 matchedPath = scripts/reconcile-install.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/reconcile-install.mjsView on unpkg

544const prepared = await commands.run(binary, CLIENT_REPAIR_ARGUMENTS, { shell: false, capture: true, environment: { ...baseEnvironment, MIKIE_NPM_UPDATE_REPAIR_PHASE: "prepare" }, }); const preparedReceipt = parseClientRepair(prepared, { allowLegacyDeferred: allowDeferred });

Medium

Suspicious Lifecycle Evidence

Postinstall invokes a platform-native binary to reconcile a trajectory store and repair Claude hooks.

scripts/reconcile-install.mjsView on unpkg · L544

Source & flagged code

8 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@getmikie/cli",

3 "version": "1.1.119",

4 "description": "Native Mikie relay launcher for MCP clients",

5 "license": "Apache-2.0",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Zyph3rKeaton/new-ai-language.git"

9 },

10 "type": "module",

11 "bin": {

12 "mikie": "bin/mikie.mjs"

13 },

14 "scripts": {

15 "postinstall": "node ./scripts/reconcile-install.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 },

Medium

Suspicious Lifecycle Evidence

The package automatically runs a postinstall script.

package.jsonView on unpkg · L14

17 "files": [

18 "bin",

19 "lib",

20 "scripts",

21 "README.md"

22 ],

23 "engines": {

24 "node": ">=22"

25 },

26 "optionalDependencies": {

27 "@getmikie/darwin-arm64": "1.1.119",

28 "@getmikie/darwin-x64": "1.1.119",

29 "@getmikie/linux-x64-gnu": "1.1.119",

30 "@getmikie/win32-x64": "1.1.119"

31 },

32 "publishConfig": {

33 "access": "public",

34 "registry": "https://registry.npmjs.org"

35 }

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

lib/launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/launcher.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/launcher.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 56afec83ce73bd5e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/launcher.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/launcher.mjsView on unpkg

lib/update.mjsView file

•matchType = normalized_sha256 matchedPackage = @getmikie/cli@1.1.118 matchedPath = lib/update.mjs matchedIdentity = npm:QGdldG1pa2llL2NsaQ:1.1.118 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/update.mjsView on unpkg

scripts/reconcile-install.mjsView file

Lines 524-564javascript

524 }

525 const preserved = explicitMarker

526 ? [authority.runtime_sha256]

527 : await retainedRuntimeDigests(markerRoot, platform);

528 if (!