@glubean/cli@0.10.5: Suspicious npm security report (Warn)

Loading npm security reports…

@glubean/cli@0.10.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 1-54javascript

1/**

2 * glubean config mcp — configure Glubean MCP server for AI coding tools.

3 *

4 * Install: delegates to `npx add-mcp` which auto-detects installed tools.

5 * Remove: manually removes from Claude Code / Codex / Cursor / Windsurf.

6 */

7import { execSync } from "node:child_process";

8import { readFile, writeFile } from

dist/commands/upgrade.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @glubean/cli@0.10.4 matchedIdentity = npm:QGdsdWJlYW4vY2xp:0.10.4 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/upgrade.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/commands/init.jsView file

871patternName = generic_password severity = medium line = 871 matchedText = body: { ..." },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

876patternName = generic_password severity = medium line = 876 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

dist/lib/git.jsView file

3*/ L4: import { execFile } from "node:child_process"; L5: import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

dist/version.jsView file

4const __dirname = dirname(fileURLToPath(import.meta.url)); L5: const require = createRequire(import.meta.url); L6: const pkg = require(resolve(__dirname, "../package.json"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L4

dist/commands/config_mcp.jsView file

34package = @glubean/cli; repositoryIdentity = glubean; dependency = @inquirer/prompts L34: async function promptTarget() { L35: const { select } = await import("@inquirer/prompts"); L36: return await select({

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/config_mcp.jsView on unpkg · L34

3* L4: * Install: delegates to `npx add-mcp` which auto-detects installed tools. L5: * Remove: manually removes from Claude Code / Codex / Cursor / Windsurf. L6: */ L7: import { execSync } from "node:child_process"; L8: import { readFile, writeFile } from "node:fs/promises";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/config_mcp.jsView on unpkg · L3

dist/commands/upgrade.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/upgrade.jsView on unpkg

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 1-54javascript

1/**

2 * glubean config mcp — configure Glubean MCP server for AI coding tools.

3 *

4 * Install: delegates to `npx add-mcp` which auto-detects installed tools.

5 * Remove: manually removes from Claude Code / Codex / Cursor / Windsurf.

6 */

7import { execSync } from "node:child_process";

8import { readFile, writeFile } from

dist/commands/upgrade.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/upgrade.jsView on unpkg

@glubean/cli@0.10.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code