@javascribe/pindoupic@0.6.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@javascribe/pindoupic@0.6.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/mcp.jsView file

21735}; L21736: var API = process.env.PINDOUPIC_API || "https://www.pindoupic.com/api/v1"; L21737: var API_BASE = API; ... L21746: if (!res.ok) return { params: RENDER_DEFAULTS, source: "builtin" }; L21747: const j = await res.json(); L21748: const pick = (key) => typeof j[key] === "number" ? j[key] : RENDER_DEFAULTS[key]; ... L21764: // ../backend/static/logo-icon-color-256.png L21765: var logo_icon_color_256_default = "data:image/png;base64,[redacted]... L21766: ... L22103: if (format === "pdf") { L22104: const { execSync } = await import("node:child_process"); L22105: const { mkdtempSync, writeFileSync: writeFileSync3, readFileSync: readFileSync2, rmSync: rmSync2 } = await import("node:fs");

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L21735

22569const imageSrc = typedArgs?.image_path || typedArgs?.image_url || typedArgs?.image_base64; if

Low

Ai Review Evidence

The MCP image source comes from caller-provided tool arguments and is processed locally.

dist/mcp.jsView on unpkg · L22569

21736var API = process.env.PINDOUPIC_API || "https://www.pindoupic.com/api/v1"; var API_BASE = API; var offline = process.env.PINDOUPIC_OFFLINE === "1" || process.env.PINDOUPIC_OFFLINE === "true"; function isOf

Low

Ai Review Evidence

Network requests use a package service URL by default, with an environment override and offline mode.

dist/mcp.jsView on unpkg · L21736

22613recordRun({ entry: "mcp", agent: "mcp-host", ms: Date.now() - genStart, width: result.pattern.width, palette: `${paletteBrand}/${paletteSub}`, type: imageType, shape: "square", mirror: !!typedArgs?.mirror, format: "png", colors: result.colorStats.length, beads: result.totalBeads, pkg: package_default.version, node: process.version

Low

Ai Review Evidence

Generation telemetry contains usage parameters and runtime metadata, rather than image contents or credentials.

dist/mcp.jsView on unpkg · L22613

22308const res = await fetch(`${API_BASE}/telemetry/run`, { method: "POST", headers: { "content-type": "application/json" }, body: lines[i], signal: AbortSignal.timeout

Low

Ai Review Evidence

Generation telemetry contains usage parameters and runtime metadata, rather than image contents or credentials.

dist/mcp.jsView on unpkg · L22308

package.jsonView file

20"scripts": { "prepack": "rm -rf skill && cp -R ../skill skill", "build": "node esbuild.config.js", "start": "node dist/cli.js", "mcp": "node dist/mcp.js", "check:cli-offline": "node ../scripts/verify-cli-offline-0927.cjs" }, "keywords": [ "拼豆图纸", "

Low

Suspicious Lifecycle Evidence

package.json has CLI and MCP commands but no automatic install lifecycle hooks or runtime self-dependency.

package.jsonView on unpkg · L20

Source & flagged code

6 flagged

dist/mcp.jsView file

Lines 21715-21756javascript

21715 if ("simplifyThresholdDefault" in out) out.simplifyThreshold = out.simplifyThresholdDefault;

21716 return out;

21717}

21718var IMAGE_TYPE_PRESETS = FALLBACK_PRESETS;

21719function getImageTypePreset(id) {

21720 return IMAGE_TYPE_PRESETS.find((p) => p.id === id);

21721}

21722var WIDTH_RANGE = { min: 10, max: 200 };

21723var MAX_CANVAS_SIDE = 8e3;

21724var MIN_CELL_SIZE = 8;

21725function fitCellSize(cols, rows, wanted) {

21726 const bySide = Math.floor(MAX_CANVAS_SIDE / Math.max(1, cols, rows));

21727 return Math.max(MIN_CELL_SIZE, Math.min(wanted, bySide));

21728}

21729var RENDER_DEFAULTS = {

21730 default_width: 80,

21731 png_cell_size: 50,

21732 png_fill_ratio_1c: 0.4,

21733 png_fill_ratio_2c: 0.5,

21734 png_fill_ratio_3c: 0.8

21735};

21736var API = process.env.PINDOUPIC_API || "https://www.pindoupic.com/api/v1";

21737var API_BASE = API;

21738var offline = process.env.PINDOUPIC_OFFLINE === "1" || process.env.PINDOUPIC_OFFLINE === "true";

21739function isOffline() {

Low

Ai Review Evidence

Network requests use a package service URL by default, with an environment override and offline mode.

dist/mcp.jsView on unpkg · L21736

21740 return offline;

21741}

21742async function loadRenderParams() {

21743 if (offline) return { params: RENDER_DEFAULTS, source: "offline" };

21744 try {

21745 const res = await fetch(`${API}/config`, { signal: AbortSignal.timeout(3e3) });

21746 if (!res.ok) return { params: RENDER_DEFAULTS, source: "builtin" };

21747 const j = await res.json();

21748 const pick = (key) => typeof j[key] === "number" ? j[key] : RENDER_DEFAULTS[key];

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L21735

21749 return {

21750 params: {

21751 default_width: pick("default_width"),

21752 png_cell_size: pick("png_cell_size"),

21753 png_fill_ratio_1c: pick("png_fill_ratio_1c"),

21754 png_fill_ratio_2c: pick("png_fill_ratio_2c"),

21755 png_fill_ratio_3c: pick("png_fill_ratio_3c")

21756 },

Lines 22288-22328javascript

22288 lines = readFileSync(mine, "utf8").split("\n").filter(Boolean);

22289 } catch {

22290 return out;

22291 }

22292 if (!

Lines 22549-22633javascript

22549 name: "list_palettes",

22550 description: "\u5217\u51FA\u672C\u5305\u5185\u7F6E\u7684\u6240\u6709\u62FC\u8C46\u8272\u677F\uFF08\u54C1\u724C + \u578B\u53F7 + \u8272\u6570\uFF09\uFF0C\u65E0\u9700\u8054\u7F51",

22551 inputSchema: { type: "object", properties: {} }

22552 },

package.jsonView file

Lines 1-40json

1{

2 "name": "@javascribe/pindoupic",

3 "version": "0.6.0",

4 "description": "pindoupic 拼豆图纸生成器 — 图片转拼豆图纸的 CLI + MCP Server。算法与色板都在包内，断网也能出图，图片不上传 / Image → bead pattern chart, CLI + MCP, works fully offline",

5 "type": "module",