@guanlin4924/devflow-pi@0.1.86: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@guanlin4924/devflow-pi@0.1.86: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/apply-opencode-go-session-hotfix.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "dev": "bun run src/cli.ts", "doctor": "bun run src/cli.ts doctor", "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs", "test:devflow-pi": "bun tes

Medium

Ai Review Evidence

The package automatically runs a post-install script.

package.jsonView on unpkg · L10

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

11const targets = [ { path: path.join(packageRoot, "node_modules/@oh-my-pi/pi-catalog/src/compat/openai.ts"), changes: [ { before: 'promptCacheSessionHeader: isGrok ? "x-grok-conv-id" : undefined,', after: `// Console Go uses this stable, r

Medium

Suspicious Dependency Evidence

That script targets source files in its bundled AI-agent dependency and applies source replacements.

bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L11

47for (const target of targets) { let source = await readFile(target.path, "utf8"); let changed = false; for (const change of target.changes) { if (source.includes(change.after)) continue; if (!source.includes(change.before)) { throw new Erro

Medium

Suspicious Dependency Evidence

That script targets source files in its bundled AI-agent dependency and applies source replacements.

bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L47

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.86",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "test:devflow-pi": "bun test tests/devflow-pi",

Medium

Ai Review Evidence

The package automatically runs a post-install script.

package.jsonView on unpkg · L10

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "release": "bash scripts/release-npm.sh"

18 },

19 "engines": {

20 "bun": ">=1.3.14"

21 },

22 "dependencies": {

23 "@oh-my-pi/pi-coding-agent": "17.2.7",

24 "@plurnk/plurnk-mimetypes-grammar-cpp": "1.16.1",

25 "@plurnk/plurnk-mimetypes-grammar-kotlin": "1.16.1",

26 "@plurnk/plurnk-mimetypes-grammar-ruby": "1.16.1",

27 "@plurnk/plurnk-mimetypes-grammar-scala": "1.16.1",

28 "@plurnk/plurnk-mimetypes-grammar-yaml": "1.16.1",

29 "tree-sitter-graphql-grammar-wasm": "1.1.0",

30 "web-tree-sitter": "0.25.10"

31 },

32 "devDependencies": {

33 "@types/bun": "^1.3.14",

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2

3import { readFile, writeFile } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath } from "node:url";

6