@guanlin4924/devflow-pi@0.1.72: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@guanlin4924/devflow-pi@0.1.72: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/apply-opencode-go-session-hotfix.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "dev": "bun run src/cli.ts", "doctor": "bun run src/cli.ts doctor", "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs", "test:devflow-pi": "bu

Medium

Ai Review Evidence

The package automatically runs a post-install hotfix.

package.jsonView on unpkg · L10

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

11const targets = [ { path: path.join(packageRoot, "node_modules/@oh-my-pi/pi-catalog/src/compat/openai.ts"), changes: [ { before: 'promptCacheSessionHeader: isGrok ? "x-grok-conv-id" : undefined,', after: `// Console Go uses this stable, runtime-provided session identifier to route a conversation. \t\t// Scope it to Go: Zen does not document this header. \t\tpromptCacheSessionHeader: isGrok \t\t\t? "x-grok-conv-id" \t\t\t: provider === "opencode-go" \t\t\t\t? "x-opencode-session" \t\t\t\t: undefined,`, }, ], },

Medium

Suspicious Dependency Evidence

The hotfix targets source files in the bundled AI-agent dependency.

bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L11

55source = source.replace(change.before, change.after); changed = true; } if (changed) await writeFile(target.path, source); } console.log("[devflow-pi] applied opencode

Medium

Suspicious Dependency Evidence

The hook replaces matched dependency source and writes the result back.

bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L55

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.72",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test:devflow-pi": "bun test tests/devflow-pi",

Medium

Ai Review Evidence

The package automatically runs a post-install hotfix.

package.jsonView on unpkg · L10

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "release": "bash scripts/release-npm.sh"

18 },

19 "engines": {

20 "bun": ">=1.3.14"

21 },

22 "dependencies": {

23 "@oh-my-pi/pi-coding-agent": "17.2.7"

24 },

25 "devDependencies": {

26 "@types/bun": "^1.3.14",

27 "typescript": "^5.9.3"

28 },

29 "files": [

30 "bin",

31 "src",

32 "plugins",

33 "!plugins/**/__pycache__",

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2

3import { readFile, writeFile } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath } from "node:url";

6