@hermenics/deepseek-code: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@hermenics/deepseek-code: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/cli.mjsView file

143. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L14

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L2

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L2

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:` ... L238: `)}},getChildHostContext($,K){let q=$.isInsideText,D=K==="ink-text"||K==="ink-virtual-text"||K==="ink-link";if(q===D)return $;return{isInsideText:D}},shouldSetTextContent:()=>!1,cr... L239: `)}function JR($,K,q,D,z){let J=hy($);if(!J||q>D)return;let{start:Y,end:X}=J,W=Math.max(q,Y.row),Z=Math.min(D,X.row);if(W>Z)re

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli.mjsView on unpkg · L2

143. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:` ... L620: - /files \u2014 List files modified this session L621: - /tools \u2014 List all available tools L622: - /system \u2014 Show active system prompt ... L768: .deepseek/worktrees/ L769: `)}async capturePatch($){let K=[...await this.changedPaths($.path)],D=(await x0("git",["ls-files","--others","--exclude-standard","-z"],{cwd:$.path,reject:!1})).stdout.split("\x00"... L770: `)}}function Bv1($,K){for(let z=K??0;z<$.length;z++){if($[z]===10)return{preceding:z,index:z+1,carriage:!1};if($[z]===13)return{preceding:z,index:z+1,car

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L14

dist/tree-sitter-markdown_inline-j5349f42.wasmView file

•path = dist/tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

Source & flagged code

6 flagged

dist/cli.mjsView file

143. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L14

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L2

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L2

2// @bun L3: var $Y1=Object.create;var{getPrototypeOf:KY1,defineProperty:vM,getOwnPropertyNames:OD8,getOwnPropertyDescriptor:qY1}=Object,GD8=Object.prototype.hasOwnProperty;function MD8($){retu... L4: ... L14: 3. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:` ... L238: `)}},getChildHostContext($,K){let q=$.isInsideText,D=K==="ink-text"||K==="ink-virtual-text"||K==="ink-link";if(q===D)return $;return{isInsideText:D}},shouldSetTextContent:()=>!1,cr... L239: `)}function JR($,K,q,D,z){let J=hy($);if(!J||q>D)return;let{start:Y,end:X}=J,W=Math.max(q,Y.row),Z=Math.min(D,X.row);if(W>Z)re

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli.mjsView on unpkg · L2

143. You might have more than one copy of React in the same app L15: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),b}function u(){K8.asyncTransitions--}function l(b){if(z0===null)try{var Y8=("requir... L16: `:` ... L620: - /files \u2014 List files modified this session L621: - /tools \u2014 List all available tools L622: - /system \u2014 Show active system prompt ... L768: .deepseek/worktrees/ L769: `)}async capturePatch($){let K=[...await this.changedPaths($.path)],D=(await x0("git",["ls-files","--others","--exclude-standard","-z"],{cwd:$.path,reject:!1})).stdout.split("\x00"... L770: `)}}function Bv1($,K){for(let z=K??0;z<$.length;z++){if($[z]===10)return{preceding:z,index:z+1,carriage:!1};if($[z]===13)return{preceding:z,index:z+1,car

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L14

dist/tree-sitter-markdown_inline-j5349f42.wasmView file

•path = dist/tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter-markdown_inline-j5349f42.wasmView on unpkg