@intellicore/cli@0.7.7: Suspicious npm security report (Warn)

Loading npm security reports…

@intellicore/cli@0.7.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

dist/chunk-TLN7YK7T.jsView file

Lines 280-320javascript

280 const action = await promptApproval(`${filePath} \uC218\uC815`);

281 if (action === "no") {

282 return { name: "file_write", success: false, output: "\uC0AC\uC6A9\uC790\uAC00 \uC218\uC815\uC744 \uAC70\uBD80\uD588\uC2B5\uB2C8\uB2E4" };

283 }

284 }

285 pushChange({ path: resolved, oldContent, newContent: content });

286 await writeFile(resolved, content, "utf-8");

287 return { name: "file_write", success: true, output: `${filePath} \uC218\uC815\uB428` };

288 } else {

289 console.log(renderNewFile(content, filePath));

290 pushChange({ path: resolved, oldContent: null, newContent: content });

291 await writeFile(resolved, content, "utf-8");

292 return { name: "file_write", success: true, output: `${filePath} \uC0DD\uC131\uB428 (\uC0C8 \uD30C\uC77C)` };

293 }

294 } catch (err) {

295 return { name: "file_write", success: false, output: err.message };

296 }

297 }

298};

299

300// src/features/tools/shell-exec.ts

301import { execSync, spawn } from "child_process";

302import { resolve as resolve3, join as join2 } from "path";

High

Child Process

Package source references child process execution.

dist/chunk-TLN7YK7T.jsView on unpkg · L300

303import { existsSync as existsSync3 } from "fs";

304

305// src/shared/ui/safety.ts

306import chalk3 from "chalk";

307var DANGEROUS_PATTERNS = [

308 /rm\s+(-rf?|--recursive)\s+[\/~]/,

309 /sudo\s+rm/,

310 /mkfs/,

311 /dd\s+if=/,

312 />\s*\/dev\/sd/,

313 /chmod\s+777\s+\//,

314 /:\{ :\|:& \};:/,

315 /curl.*\|\s*(bash|sh)/,

316 /wget.*\|\s*(bash|sh)/

317];

318function isDangerous(command) {

319 return DANGEROUS_PATTERNS.some((p) => p.test(command));

320}

•matchType = previous_version_dangerous_delta matchedPackage = @intellicore/cli@0.7.6 matchedIdentity = npm:QGludGVsbGljb3JlL2NsaQ:0.7.6 similarity = 0.977 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-TLN7YK7T.jsView on unpkg

dist/knowledge-VZYH555V.jsView file

Lines 60-100javascript

60 if (tokens > MAX_CHUNK_TOKENS) {

61 chunks.push(...splitChunk(path, lines, start, end));

62 } else {

63 chunks.push({

64 id: createHash(

dist/update-C67XPWZS.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import "./chunk-7OCVIDC7.js";

4// src/features/update/update.ts

5import { execSync } from "child_process";

6import chalk from "chalk";

7async

Source & flagged code

4 flagged · loading source

dist/chunk-TLN7YK7T.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-TLN7YK7T.jsView on unpkg

300// src/features/tools/shell-exec.ts L301: import { execSync, spawn } from "child_process"; L302: import { resolve as resolve3, join as join2 } from "path";

High

Child Process

Package source references child process execution.

dist/chunk-TLN7YK7T.jsView on unpkg · L300

dist/knowledge-VZYH555V.jsView file

80/^(?:export\s+)?const\s+\w+\s*=\s*(?:async\s*)?\(/, L81: /^(?:public|private|protected)\s+(?:static\s+)?(?:async\s+)?\w+\s*\(/, L82: /^def\s+\w+/, ... L176: try { L177: const data = JSON.parse(readFileSync(storePath, "utf-8")); L178: this.chunks = data.chunks;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/knowledge-VZYH555V.jsView on unpkg · L80

dist/update-C67XPWZS.jsView file

19console.log(chalk.blue(" \u280B \uC5C5\uB370\uC774\uD2B8 \uC911...")); L20: execSync("npm install -g @intellicore/cli@latest", { L21: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update-C67XPWZS.jsView on unpkg · L19

Source & flagged code

4 flagged

dist/chunk-TLN7YK7T.jsView file

Lines 280-320javascript

280 const action = await promptApproval(`${filePath} \uC218\uC815`);

281 if (action === "no") {

282 return { name: "file_write", success: false, output: "\uC0AC\uC6A9\uC790\uAC00 \uC218\uC815\uC744 \uAC70\uBD80\uD588\uC2B5\uB2C8\uB2E4" };

283 }

284 }

285 pushChange({ path: resolved, oldContent, newContent: content });

286 await writeFile(resolved, content, "utf-8");

287 return { name: "file_write", success: true, output: `${filePath} \uC218\uC815\uB428` };

288 } else {

289 console.log(renderNewFile(content, filePath));

290 pushChange({ path: resolved, oldContent: null, newContent: content });

291 await writeFile(resolved, content, "utf-8");

292 return { name: "file_write", success: true, output: `${filePath} \uC0DD\uC131\uB428 (\uC0C8 \uD30C\uC77C)` };

293 }

294 } catch (err) {

295 return { name: "file_write", success: false, output: err.message };

296 }

297 }

298};

299

300// src/features/tools/shell-exec.ts

301import { execSync, spawn } from "child_process";

302import { resolve as resolve3, join as join2 } from "path";

High

Child Process

Package source references child process execution.

dist/chunk-TLN7YK7T.jsView on unpkg · L300

303import { existsSync as existsSync3 } from "fs";

304

305// src/shared/ui/safety.ts

306import chalk3 from "chalk";

307var DANGEROUS_PATTERNS = [

308 /rm\s+(-rf?|--recursive)\s+[\/~]/,

309 /sudo\s+rm/,

310 /mkfs/,

311 /dd\s+if=/,

312 />\s*\/dev\/sd/,

313 /chmod\s+777\s+\//,

314 /:\{ :\|:& \};:/,

315 /curl.*\|\s*(bash|sh)/,

316 /wget.*\|\s*(bash|sh)/

317];

318function isDangerous(command) {

319 return DANGEROUS_PATTERNS.some((p) => p.test(command));

320}

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-TLN7YK7T.jsView on unpkg

dist/knowledge-VZYH555V.jsView file

Lines 60-100javascript

60 if (tokens > MAX_CHUNK_TOKENS) {

61 chunks.push(...splitChunk(path, lines, start, end));

62 } else {

63 chunks.push({

64 id: createHash(

dist/update-C67XPWZS.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import "./chunk-7OCVIDC7.js";

4// src/features/update/update.ts

5import { execSync } from "child_process";

6import chalk from "chalk";

7async

@intellicore/cli@0.7.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code