@guanlin4924/devflow-pi: Manual Review npm security report

Loading npm security reports…

@guanlin4924/devflow-pi: Manual Review npm security report | LPM Firewall

Source & flagged code

18 flagged

package.jsonView file

Lines 1-33json

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.97",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test:devflow-pi": "bun test tests/devflow-pi",

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "build:runtime": "bun scripts/build-runtime.ts",

18 "check:runtime": "bun scripts/build-runtime.ts --check",

19 "release": "bash scripts/release-npm.sh"

20 },

21 "engines": {

22 "bun": ">=1.3.14",

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@modelcontextprotocol/sdk": "1.32.1",

27 "@oh-my-pi/pi-coding-agent": "17.2.7",

28 "@playwright/test": "1.63.0",

29 "@plurnk/plurnk-mimetypes-grammar-cpp": "1.16.1",

30 "@plurnk/plurnk-mimetypes-grammar-kotlin": "1.16.1",

31 "@plurnk/plurnk-mimetypes-grammar-ruby": "1.16.1",

32 "@plurnk/plurnk-mimetypes-grammar-scala": "1.16.1",

33 "@plurnk/plurnk-mimetypes-grammar-yaml": "1.16.1",

src/platform-extension.tsView file

Lines 1-22typescript

1import type { ExtensionAPI, ExtensionUIContext } from "@oh-my-pi/pi-coding-agent";

2import { mkdir, writeFile } from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from

node_modules/playwright-core/lib/utilsBundle.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/utilsBundle.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

123var hasFlag = require_has_flag(); L124: var env = process.env; L125: var forceColor = void 0; ... L158: var min = forceColor ? 1 : 0; L159: if (process.platform === "win32") { L160: var osRelease = os2.release().split("."); ... L207: supportsColor: getSupportLevel, L208: stdout: getSupportLevel(process.stdout), L209: stderr: getSupportLevel(process.stderr) ... L636: if (typeof theme === "string") { L637: console.log("colors.setTheme now only accepts an object, not a string. If you are trying to set a theme from a file, it is now your (the caller's) responsibility to require the fi... L638: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg · L123

node_modules/playwright/lib/runner/index.jsView file

Lines 844-884javascript

844 await this._waitForProcess();

845 } catch (error) {

846 await this.teardown();

847 throw error;

848 }

node_modules/playwright/lib/common/index.jsView file

Lines 58-98javascript

58 affectedTestFiles: () => affectedTestFiles,

59 belongsToNodeModules: () => belongsToNodeModules,

60 cacheDir: () => cacheDir,

61 collectAffectedTestFiles: () => collectAffectedTestFiles,

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView file

165contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView on unpkg · L165

node_modules/playwright-core/lib/coreBundle.jsView file

552Cross-file remote execution chain: node_modules/playwright-core/lib/coreBundle.js spawns node_modules/playwright-core/lib/vite/traceViewer/sw.bundle.js; helper contains network access plus dynamic code execution. L552: function truncateDataUrl(url3) { L553: if (!url3.startsWith("data:")) L554: return url3; ... L647: default: L648: const code = c.charCodeAt(0); L649: return "\\x" + code.toString(16).padStart(2, "0"); ... L4090: ["BrowserContext.setNetworkInterceptionPatterns", { title: "Route requests", group: "route" }], L4091: ["BrowserContext.[redacted]", { title: "Route WebSockets", group: "route" }], L4092: ["BrowserContext.setOffline", { title: "Set offline mode", renderParams: ["offline"] }], ... L5946: } L5947: case "stdout": { L5948: contextEntry.stdio.push(event);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L552

node_modules/playwright-core/lib/webp_codec.wasmView file

•path = node_modules/playwright-core/lib/webp_codec.wasm kind = wasm_module sizeBytes = 565369 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/playwright-core/lib/webp_codec.wasmView on unpkg

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View on unpkg

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/tools/cli-client/channelSessions.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

node_modules/playwright/lib/agents/generateAgents.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules[redacted].js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/agents/generateAgents.jsView on unpkg

node_modules/playwright/lib/cli/testActions.jsView file

•matchType = token_shingles matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright/lib/cli/testActions.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/cli/testActions.jsView on unpkg

node_modules/playwright/lib/util.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright/lib/util.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/util.jsView on unpkg

plugins/devflow-design/extensions/devflow-design.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-design/extensions/devflow-design.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-design/extensions/devflow-design.tsView on unpkg

plugins/devflow-quality/extensions/devflow-quality.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-quality/extensions/devflow-quality.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-quality/extensions/devflow-quality.tsView on unpkg

src/doctor.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.95 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.95 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/doctor.tsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/apply-opencode-go-session-hotfix.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/platform-extension.tsView file

2import { mkdir, writeFile } from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

src/platform-extension.tsView on unpkg · L2

node_modules/playwright-core/lib/utilsBundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg · L123

node_modules/playwright/lib/runner/index.jsView file

864const port = new URL(this._options.url).port; L865: throw new Error(`${this._options.url ?? `http://localhost${port ? ":" + port : ""}`} is already used, make sure that nothing is running on the port/url or set reuseExistingServer:t... L866: } ... L873: ...DEFAULT_ENVIRONMENT_VARIABLES, L874: ...process.env, L875: ...this._options.env ... L878: stdio: "stdin", L879: shell: true, L880: attemptToGracefullyClose: async () => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

node_modules/playwright/lib/runner/index.jsView on unpkg · L864

node_modules/playwright/lib/common/index.jsView file

78var { calculateSha1 } = require("playwright-core/lib/coreBundle").utils; L79: var cacheDir = process.env.PWTEST_CACHE_DIR || (() => { L80: if (process.platform === "win32") L81: return import_path.default.join(import_os.default.tmpdir(), `playwright-transform-cache`); ... L97: return { L98: map: JSON.parse(import_fs.default.readFileSync(sourceMapPath, "utf-8")), L99: url: source ... L361: return file2; L362: return import_path2.default.relative(process.cwd(), file2); L363: } ... L375: return cached; L376: const packageJsonPath = import_path2.default.join(folderPath, "package.json");

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

node_modules/playwright/lib/common/index.jsView on unpkg · L78

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView on unpkg · L165

node_modules/playwright-core/lib/coreBundle.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L552

node_modules/playwright-core/lib/webp_codec.wasmView file

•path = node_modules/playwright-core/lib/webp_codec.wasm kind = wasm_module sizeBytes = 565369 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/playwright-core/lib/webp_codec.wasmView on unpkg

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View on unpkg

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

node_modules/playwright/lib/agents/generateAgents.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/agents/generateAgents.jsView on unpkg

node_modules/playwright/lib/cli/testActions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/cli/testActions.jsView on unpkg

node_modules/playwright/lib/util.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/util.jsView on unpkg

plugins/devflow-design/extensions/devflow-design.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-design/extensions/devflow-design.tsView on unpkg

plugins/devflow-quality/extensions/devflow-quality.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-quality/extensions/devflow-quality.tsView on unpkg

src/doctor.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/doctor.tsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 1-33json

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.97",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test:devflow-pi": "bun test tests/devflow-pi",

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "build:runtime": "bun scripts/build-runtime.ts",

18 "check:runtime": "bun scripts/build-runtime.ts --check",

19 "release": "bash scripts/release-npm.sh"

20 },

21 "engines": {

22 "bun": ">=1.3.14",

23 "node": ">=20"

24 },

25 "dependencies": {

26 "@modelcontextprotocol/sdk": "1.32.1",

27 "@oh-my-pi/pi-coding-agent": "17.2.7",

28 "@playwright/test": "1.63.0",

29 "@plurnk/plurnk-mimetypes-grammar-cpp": "1.16.1",

30 "@plurnk/plurnk-mimetypes-grammar-kotlin": "1.16.1",

31 "@plurnk/plurnk-mimetypes-grammar-ruby": "1.16.1",

32 "@plurnk/plurnk-mimetypes-grammar-scala": "1.16.1",

33 "@plurnk/plurnk-mimetypes-grammar-yaml": "1.16.1",

src/platform-extension.tsView file

Lines 1-22typescript

1import type { ExtensionAPI, ExtensionUIContext } from "@oh-my-pi/pi-coding-agent";

2import { mkdir, writeFile } from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from

node_modules/playwright-core/lib/utilsBundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/playwright-core/lib/utilsBundle.jsView on unpkg · L123

node_modules/playwright/lib/runner/index.jsView file

Lines 844-884javascript

844 await this._waitForProcess();

845 } catch (error) {

846 await this.teardown();

847 throw error;

848 }

node_modules/playwright/lib/common/index.jsView file

Lines 58-98javascript

58 affectedTestFiles: () => affectedTestFiles,

59 belongsToNodeModules: () => belongsToNodeModules,

60 cacheDir: () => cacheDir,

61 collectAffectedTestFiles: () => collectAffectedTestFiles,

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Ds6CBOo0.jsView on unpkg · L165

node_modules/playwright-core/lib/coreBundle.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

node_modules/playwright-core/lib/coreBundle.jsView on unpkg · L552

node_modules/playwright-core/lib/webp_codec.wasmView file

•path = node_modules/playwright-core/lib/webp_codec.wasm kind = wasm_module sizeBytes = 565369 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/playwright-core/lib/webp_codec.wasmView on unpkg

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

plugins/devflow-quality/runtime/playwright/explore-host.mjs#virtual:normalized:round1View on unpkg

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

node_modules/playwright/lib/agents/generateAgents.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/agents/generateAgents.jsView on unpkg

node_modules/playwright/lib/cli/testActions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/cli/testActions.jsView on unpkg

node_modules/playwright/lib/util.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/playwright/lib/util.jsView on unpkg

plugins/devflow-design/extensions/devflow-design.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-design/extensions/devflow-design.tsView on unpkg

plugins/devflow-quality/extensions/devflow-quality.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-quality/extensions/devflow-quality.tsView on unpkg

src/doctor.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/doctor.tsView on unpkg

@guanlin4924/devflow-pi@0.1.97

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code