@guanlin4924/devflow-pi@0.1.94: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@guanlin4924/devflow-pi@0.1.94: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/apply-opencode-go-session-hotfix.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "dev": "bun run src/cli.ts", "doctor": "bun run src/cli.ts doctor", "postinstall": "node bin/apply-opencode-go-session-hotf

Medium

Suspicious Lifecycle Evidence

The package declares an automatic postinstall hook.

package.jsonView on unpkg · L10

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

50for (const change of target.changes) { if (source.includes(change.after)) continue; if (!source.includes(change.before)) { throw new Error(`Unsupported OMP 17.2.7 source layout: ${target.path}`); } source = source.replace(change.before, change.after); changed = true; }

Medium

Suspicious Lifecycle Evidence

The postinstall script replaces source text in installed OMP dependency files.

bin/apply-opencode-go-session-hotfix.mjsView on unpkg · L50

src/runtime.tsView file

106const roots = pluginRoots(); // Task workers perform a fresh agent discovery after session creation. The // SDK's temporary extension-root scope does not cover that later lookup, // so register Devflow package roots as durable CLI roots for this process. // Without this, packaged agents such as implementation-worker appear during // startup but fail with Unknown agent when a parallel task is dispatched. injectOmpExtensionCliRoots(roots, homedir(), project.root, { mode: "explicit-on

Medium

Ai Review Evidence

The runtime registers packaged extension roots using the user home and project root.

src/runtime.tsView on unpkg · L106

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@guanlin4924/devflow-pi",

3 "version": "0.1.94",

4 "type": "module",

5 "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",

6 "license": "UNLICENSED",

7 "bin": {

8 "devflow-pi": "bin/devflow-pi"

9 },

10 "scripts": {

11 "dev": "bun run src/cli.ts",

12 "doctor": "bun run src/cli.ts doctor",

13 "postinstall": "node bin/apply-opencode-go-session-hotfix.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Suspicious Lifecycle Evidence

The package declares an automatic postinstall hook.

package.jsonView on unpkg · L10

14 "test:devflow-pi": "bun test tests/devflow-pi",

15 "test": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

16 "check": "bun test tests/devflow-pi && python3 -m unittest discover -s tests -p 'test_*.py'",

17 "release": "bash scripts/release-npm.sh"

18 },

19 "engines": {

20 "bun": ">=1.3.14"

21 },

22 "dependencies": {

23 "@oh-my-pi/pi-coding-agent": "17.2.7",

24 "@plurnk/plurnk-mimetypes-grammar-cpp": "1.16.1",

25 "@plurnk/plurnk-mimetypes-grammar-kotlin": "1.16.1",

26 "@plurnk/plurnk-mimetypes-grammar-ruby": "1.16.1",

27 "@plurnk/plurnk-mimetypes-grammar-scala": "1.16.1",

28 "@plurnk/plurnk-mimetypes-grammar-yaml": "1.16.1",

29 "tree-sitter-graphql-grammar-wasm": "1.1.0",

30 "web-tree-sitter": "0.25.10"

31 },

32 "devDependencies": {

33 "@types/bun": "^1.3.14",

plugins/devflow-core/runtime/hooks/post_tool.pyView file

•path = plugins/devflow-core/runtime/hooks/post_tool.py kind = build_helper sizeBytes = 1285 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/devflow-core/runtime/hooks/post_tool.pyView on unpkg

plugins/devflow-intel/extensions/devflow-intel.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guanlin4924/devflow-pi@0.1.47 matchedIdentity = npm:QGd1YW5saW40OTI0L2RldmZsb3ctcGk:0.1.47 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/devflow-intel/extensions/devflow-intel.tsView on unpkg

bin/apply-opencode-go-session-hotfix.mjsView file

Lines 30-62javascript

30 {

31 before: "\tgetOpenAIPromptCacheKey,\n",

32 after: "\tgetOpenAIPromptCacheKey,\n\tnormalizeOpenAIPromptCacheKey,\n",

33 },

src/runtime.tsView file

Lines 86-126typescript

86 // embedded Devflow logs private as well, including in sandboxed test runs.

87 await Promise.all([

88 mkdir(productAgentDir, { recursive: true }),

89 mkdir(sessionDir, { recursive: true }),

90 mkdir(path.