@guanlin4924/devflow-pi@0.1.81: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@guanlin4924/devflow-pi@0.1.81: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/apply-opencode-go-session-hotfix.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-design/extensions/devflow-design.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-design/extensions/devflow-design.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-design/extensions/devflow-design.tsView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-intel/extensions/devflow-intel.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.95 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.95 similarity = 0.524 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

plugins/devflow-quality/extensions/devflow-quality.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-quality/extensions/devflow-quality.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-quality/extensions/devflow-quality.tsView on unpkg

src/project-documents.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/project-documents.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/project-documents.tsView on unpkg

src/project-initializer.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/project-initializer.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/project-initializer.tsView on unpkg

src/platform-extension.tsView file

•matchType = malicious_source_fingerprint_signature signature = e171489f76f10f12 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/platform-extension.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 shingleOverlap = 18 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/platform-extension.tsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.81",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test:devflow-pi": "bun test tests/devflow-pi",

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "release": "bash scripts/release-npm.sh"

18 },

19 "engines": {

20 "bun": ">=1.3.14"

21 },

22 "dependencies": {

23 "@oh-my-pi/pi-coding-agent": "17.2.7",

24 "@plurnk/plurnk-mimetypes-grammar-cpp": "1.16.1",

25 "@plurnk/plurnk-mimetypes-grammar-kotlin": "1.16.1",

26 "@plurnk/plurnk-mimetypes-grammar-ruby": "1.16.1",

27 "@plurnk/plurnk-mimetypes-grammar-scala": "1.16.1",

28 "@plurnk/plurnk-mimetypes-grammar-yaml": "1.16.1",

29 "tree-sitter-graphql-grammar-wasm": "1.1.0",

30 "web-tree-sitter": "0.25.10"

31 },

32 "devDependencies": {

33 "@types/bun": "^1.3.14",

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-design/extensions/devflow-design.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-design/extensions/devflow-design.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-design/extensions/devflow-design.tsView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-intel/extensions/devflow-intel.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.95 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.95 similarity = 0.524 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

plugins/devflow-quality/extensions/devflow-quality.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = plugins/devflow-quality/extensions/devflow-quality.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/devflow-quality/extensions/devflow-quality.tsView on unpkg

src/project-documents.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/project-documents.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/project-documents.tsView on unpkg

src/project-initializer.tsView file

•matchType = normalized_sha256 matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/project-initializer.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/project-initializer.tsView on unpkg

src/platform-extension.tsView file

•matchType = malicious_source_fingerprint_signature signature = e171489f76f10f12 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @guanlin4924/devflow-pi@0.1.82 matchedPath = src/platform-extension.ts matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.82 similarity = 1.000 shingleOverlap = 18 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/platform-extension.tsView on unpkg