@igovet/opencode-tui-tunnel@0.3.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@igovet/opencode-tui-tunnel@0.3.1: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/server/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @igovet/opencode-tui-tunnel@0.3.0 matchedIdentity = npm:[redacted]:0.3.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/index.jsView on unpkg

132}); L133: import { execFile as execFile2 } from "child_process"; L134: import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L132

3097const escapedDir = needsQuoting ? `"${dirPart.replace(/"/g, '\\"')}"` : dirPart; L3098: const remoteCmd = `bash -c 'find ${escapedDir} -mindepth 1 -maxdepth 1 -type d 2>/dev/null'`; L3099: console.log("[suggestRemotePaths] partial=", partial, "dirPart=", dirPart, "prefixPart=", prefixPart, "remoteCmd=", remoteCmd);

High

Shell

Package source references shell execution.

dist/server/index.jsView on unpkg · L3097

dist/cli/bin.jsView file

84vapidPublicKey: "", L85: vapidPrivateKey: "" L86: }, ... L95: function getConfigDir() { L96: return join(homedir(), ".config", "opencode-tui-tunnel"); L97: } ... L116: const raw = readFileSync(configPath, "utf8"); L117: const parsed = JSON.parse(raw); L118: return mergeDefaults(defaults, parsed); ... L152: }); L153: import { execFile as execFile2 } from "child_process"; L154: import { existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync } from "fs";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/bin.jsView on unpkg · L84

84Trigger-reachable chain: manifest.bin -> dist/cli/bin.js L84: vapidPublicKey: "", L85: vapidPrivateKey: "" L86: }, ... L95: function getConfigDir() { L96: return join(homedir(), ".config", "opencode-tui-tunnel"); L97: } ... L116: const raw = readFileSync(configPath, "utf8"); L117: const parsed = JSON.parse(raw); L118: return mergeDefaults(defaults, parsed); ... L152: }); L153: import { execFile as execFile2 } from "child_process"; L154: import { existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync } from "fs";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/bin.jsView on unpkg · L84

84Detached bundled service listener: dist/cli/bin.js launches a Node helper and exposes a broad-bound HTTP listener. L84: vapidPublicKey: "", L85: vapidPrivateKey: "" L86: }, ... L95: function getConfigDir() { L96: return join(homedir(), ".config", "opencode-tui-tunnel"); L97: } ... L116: const raw = readFileSync(configPath, "utf8"); L117: const parsed = JSON.parse(raw); L118: return mergeDefaults(defaults, parsed); ... L152: }); L153: import { execFile as execFile2 } from "child_process"; L154: import { existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync } from "fs";

dist/assets/opencode-tui-notify.jsView file

1import { execFile } from 'node:child_process'; L2: import { basename } from 'node:path'; ... L4: L5: const NOTIFY_ENDPOINT = `${process.env.OPENCODE_TUI_TUNNEL_URL ?? 'http://127.0.0.1:4096'}/api/opencode-notify`; L6: const DEDUPE_WINDOW_MS = 1500;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/assets/opencode-tui-notify.jsView on unpkg · L1

dist/web/sounds/notification.mp3View file

•path = dist/web/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 34272 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/sounds/notification.mp3View on unpkg

Source & flagged code

9 flagged

dist/server/index.jsView file

Lines 112-152javascript

112}

113var CONFIG_VERSION;

114var init_config = __esm({

115 "src/config/index.ts"() {

116 "use strict";

117 CONFIG_VERSION = 3;

118 }

119});

120

121// src/sshfs/adapter.ts

122var adapter_exports = {};

123__export(adapter_exports, {

124 checkSshfsAvailable: () => checkSshfsAvailable,

125 cleanupAllMounts: () => cleanupAllMounts,

126 cleanupStaleMounts: () => cleanupStaleMounts,

127 getMountBaseDir: () => getMountBaseDir,

128 getMountPoint: () => getMountPoint,

129 isMountActive: () => isMountActive,

130 mountRemoteDirectory: () => mountRemoteDirectory,

131 unmountRemoteDirectory: () => unmountRemoteDirectory

132});

133import { execFile as execFile2 } from "child_process";

134import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L132

135import { homedir as homedir4 } from "os";

136import { join as join6 } from "path";

137import { promisify as promisify2 } from "util";

138function expandHomePath2(inputPath) {

139 if (inputPath === "~") {

140 return homedir4();

141 }

142 if (inputPath.startsWith("~/")) {

143 return join6(homedir4(), inputPath.slice(2));

144 }

145 return inputPath;

146}

147async function checkSshfsAvailable() {

148 try {

149 const { stdout } = await execFileAsync2("which", ["sshfs"]);

150 const path2 = stdout.trim();

151 if (path2.length > 0) {

152 return { available: true, path: path2 };

Lines 3077-3117javascript

3077 const trimmed = partial.trim();

3078 let dirPart;

3079 let prefixPart;

3080 if (trimmed.length === 0 || trimmed ===

•matchType = previous_version_dangerous_delta matchedPackage = @igovet/opencode-tui-tunnel@0.3.0 matchedIdentity = npm:[redacted]:0.3.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/index.jsView on unpkg

dist/cli/bin.jsView file

Lines 64-104javascript

64 scrollbackLines: 5e3,

65 reconnectTokenTtlSeconds: 86400,

66 retainExitedSessionHours: 24

67 },

68 security: {

69 listenMode:

dist/assets/opencode-tui-notify.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { basename } from 'node:path';

3import { promisify } from 'node:util';

4

5const NOTIFY_ENDPOINT

dist/web/sounds/notification.mp3View file

•path = dist/web/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 34272 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/sounds/notification.mp3View on unpkg