Loading npm security reports…

@ironbee-ai/cli@0.39.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @ironbee-ai/cli / 0.39.0

@ironbee-ai/cli@0.39.0

⚠ Under review

The CLI for IronBee — Verification and Intelligence Layer for Agentic Development

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 297 file(s), 1.16 MB of source, external domains: 127.0.0.1, acme.atlassian.net, api.anthropic.com, api.example.com, api.github.com, api.linear.app, api.openai.com, api2.cursor.sh, collector.service.ironbee.ai, console.ironbee.ai, github.com, id.atlassian.com, linear.app, registry.npmjs.org, your-collector.example.com

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "dist",

11 "scripts/run-postinstall.js",

12 "scripts/run-preuninstall.js",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md"

16 ],

17 "scripts": {

18 "build": "tsc --noEmit && node scripts/build.js && node scripts/copy-assets.js",

19 "dev": "ts-node src/index.ts",

20 "start": "node dist/index.js",

21 "otel-collector": "ts-node src/otel/collector.ts",

22 "test": "jest",

23 "lint": "eslint .",

24 "lint:fix": "eslint . --fix",

25 "clean": "rm -rf dist",

26 "prepack": "npm run clean && npm run build",

27 "release:patch": "release-it patch --ci -VV",

28 "release:minor": "release-it minor --ci -VV",

29 "release:major": "release-it major --ci -VV",

30 "postinstall": "node scripts/run-postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "preuninstall": "node scripts/run-preuninstall.js"

32 },

33 "keywords": [

34 "ai",

35 "ai-agent",

36 "verification",

37 "intelligence",

38 "browser-testing",

39 "claude",

40 "claude-code",

41 "cursor",

42 "cursor-ide",

43 "mcp",

44 "mcp-server",

45 "browser-devtools",

46 "coding-agent",

47 "agentic",

48 "devtools",

49 "e2e",

50 "qa",

dist/clients/cursor/usage.jsView file

Lines 1-2javascript

1"use strict";var c=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var w=Object.prototype.hasOwnProperty;var u=(n

dist/clients/session-id.jsView file

Lines 1-2javascript

1"use strict";var t=Object.defineProperty;var d=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var u=Object.prototype.hasOwnProperty;var r=(n,

dist/otel/claude/daemon/ensure.jsView file

Lines 1-2javascript

1"use strict";var l=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var H=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var i=

dist/clients/claude/oauth.jsView file

Lines 1-2javascript

1"use strict";var a=Object.defineProperty;var O=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var i=(

dist/tui/shell/shell.jsView file

Lines 1-5javascript

1"use strict";var k=Object.create;var c=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var E=Object.getPrototypeOf,H=Object

dist/clients/claude/hooks/session-status.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ironbee-ai/cli@0.34.0 matchedIdentity = npm:QGlyb25iZWUtYWkvY2xp:0.34.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/clients/claude/hooks/session-status.jsView on unpkg

Source & flagged code

7 flagged · loading source

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "dist",

11 "scripts/run-postinstall.js",

12 "scripts/run-preuninstall.js",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md"

16 ],

17 "scripts": {

18 "build": "tsc --noEmit && node scripts/build.js && node scripts/copy-assets.js",

19 "dev": "ts-node src/index.ts",

20 "start": "node dist/index.js",

21 "otel-collector": "ts-node src/otel/collector.ts",

22 "test": "jest",

23 "lint": "eslint .",

24 "lint:fix": "eslint . --fix",

25 "clean": "rm -rf dist",

26 "prepack": "npm run clean && npm run build",

27 "release:patch": "release-it patch --ci -VV",

28 "release:minor": "release-it minor --ci -VV",

29 "release:major": "release-it major --ci -VV",

30 "postinstall": "node scripts/run-postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "preuninstall": "node scripts/run-preuninstall.js"

32 },

33 "keywords": [

34 "ai",

35 "ai-agent",

36 "verification",

37 "intelligence",

38 "browser-testing",

39 "claude",

40 "claude-code",

41 "cursor",

42 "cursor-ide",

43 "mcp",

44 "mcp-server",

45 "browser-devtools",

46 "coding-agent",

47 "agentic",

48 "devtools",

49 "e2e",

50 "qa",

dist/clients/cursor/usage.jsView file

Lines 1-2javascript

1"use strict";var c=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var w=Object.prototype.hasOwnProperty;var u=(n

dist/clients/session-id.jsView file

Lines 1-2javascript

1"use strict";var t=Object.defineProperty;var d=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var u=Object.prototype.hasOwnProperty;var r=(n,

dist/otel/claude/daemon/ensure.jsView file

Lines 1-2javascript

1"use strict";var l=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var H=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var i=

dist/clients/claude/oauth.jsView file

Lines 1-2javascript

1"use strict";var a=Object.defineProperty;var O=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var i=(

dist/tui/shell/shell.jsView file

Lines 1-5javascript

1"use strict";var k=Object.create;var c=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var E=Object.getPrototypeOf,H=Object

dist/clients/claude/hooks/session-status.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/clients/claude/hooks/session-status.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code