@godxjp/ui@18.6.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@godxjp/ui@18.6.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

package.jsonView file

Lines 340-380json

340 "check:mcp-token-sync": "node scripts/gen-component-tokens.mjs --check",

341 "gen:email-tokens": "node scripts/gen-email-tokens.mjs",

342 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

343 "check:core-isolation": "node scripts/check-core-isolation.mjs",

344 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

345 "release": "node scripts/release.mjs",

346 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

347 "preview:build": "vite build --config preview/vite.config.ts",

348 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

349 "audit": "node scripts/ui-audit.mjs",

350 "audit:examples": "node scripts/ui-audit.mjs docs",

351 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

352 "dev": "node scripts/dev.mjs",

353 "prepublishOnly": "pnpm run build",

354 "check:audit-sync": "node scripts/check-audit-sync.mjs",

355 "check:contrast": "node scripts/check-contrast.mjs",

356 "visual-audit": "node scripts/visual-audit.mjs",

357 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

358 "check:frame-axe": "node scripts/check-frame-axe.mjs",

359 "check:frame-geometry": "node scripts/frame-geometry.mjs",

360 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L360

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L360

361 "init-agent": "node scripts/init-agent-kit.mjs",

362 "check:use-client": "node scripts/check-use-client.mjs"

363 },

364 "peerDependencies": {

365 "@axe-core/playwright": "*",

366 "@hookform/resolvers": "^5.2.0",

367 "@tanstack/react-query": ">=5.0.0",

368 "axe-core": "*",

369 "playwright": "*",

370 "react": ">=19.0.0",

371 "react-dom": ">=19.0.0",

372 "react-hook-form": "^7.76.0",

373 "react-router-dom": ">=7.0.0",

374 "recharts": "^2.13.0 || ^3.0.0",

375 "tailwindcss": ">=4.0.0",

376 "zod": "^4.4.0"

377 },

378 "peerDependenciesMeta": {

379 "recharts": {

380 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-26javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from