@jolli.ai/cli@0.99.13: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@jolli.ai/cli@0.99.13: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ProducerHooks.js#virtual:string-array:round1View file

390} L391: var xt = S("CodexSkillScanner"), Z = "SKILL.md", W = /[^\s"']*/skills(?:-[a-z]+)?/([^/s""]+)/SKILL.md/g, Ut = /[*?[]{}]/;\nfunction Ft(t, e) {\n const s = /* @__PURE__ */ new Map(... L392: ORDER BY seq LIMIT ?)`).run(s, Us), o = Number(n?.changes ?? 0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ProducerHooks.js#virtual:string-array:round1View on unpkg · L390

dist/McpServer.jsView file

46try { L47: const n = await B(e ?? Ke(), "utf-8"), t = JSON.parse(n); L48: if (!V(t) || typeof t.checkedAt != "string" || typeof t.ttlHours != "number" || !(t.ttlHours > 0) || !V(t.packages)) return null; ... L279: }; L280: if (process.env.JOLLI_NO_PLUGINS === "1") return { L281: known: n, ... L352: if (e?.rootsOverride) return e.rootsOverride; L353: const n = [], t = process.cwd(), o = xe(t).root, r = e?.homedirOverride ?? cn(), s = ((p) => { L354: let m = p; ... L414: if (!c.isDirectory() && !c.isSymbolicLink()) continue; L415: const p = C(l, c.name), m = C(p, "package.json"); L416: if (!_(m)) continue;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/McpServer.jsView on unpkg · L46

dist/graph-assets/vendor/elk.bundled.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/graph-assets/vendor/elk.bundled.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 26-66json

26 "schemas/",

27 "README.md"

28 ],

29 "scripts": {

30 "all": "npm run clean && npm run build && npm run lint && npm run test",

31 "build": "vite build && tsc --project tsconfig.build.json",

32 "postbuild": "node -e \"require('fs').chmodSync('dist/Cli.js', 0o755)\"",

33 "clean": "rimraf dist/",

34 "typecheck": "tsc --noEmit",

35 "lint": "biome check --error-on-warnings",

36 "lint:fix": "biome check --write",

37 "cli": "tsx src/Cli.ts",

38 "cli:build": "npm run build && node dist/Cli.js",

39 "gen:telemetry-doc": "tsx scripts/gen-telemetry-doc.mjs",

40 "test": "vitest run --coverage",

41 "test:fast": "vitest run --mode fast --coverage --reporter=dot",

42 "test:slow": "vitest run --mode slow --reporter=dot",

43 "test:changed": "vitest run --changed origin/main --reporter=dot",

44 "test:watch": "vitest",

45 "test:acceptance": "vitest run --config vitest.acceptance.config.ts",

46 "postinstall": "node -e \"require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 },

48 "keywords": [

49 "ai",

50 "ai-agent",

51 "coding-agent",

52 "mcp",

53 "model-context-protocol",

54 "memory",

55 "documentation",

56 "git-hooks",

57 "claude-code",

58 "codex",

59 "gemini",

60 "opencode",

61 "kimi",

62 "cursor",

63 "copilot",

64 "cline",

65 "devin",

66 "antigravity",

dist/ProducerHooks.js#virtual:string-array:round1View file

390} L391: var xt = S("CodexSkillScanner"), Z = "SKILL.md", W = /[^\s"']*/skills(?:-[a-z]+)?/([^/s""]+)/SKILL.md/g, Ut = /[*?[]{}]/;\nfunction Ft(t, e) {\n const s = /* @__PURE__ */ new Map(... L392: ORDER BY seq LIMIT ?)`).run(s, Us), o = Number(n?.changes ?? 0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ProducerHooks.js#virtual:string-array:round1View on unpkg · L390

dist/McpServer.jsView file

Lines 26-66javascript

26import { homedir as cn } from "node:os";

27import { fileURLToPath as ln, pathToFileURL as un } from "node:url";

28import { existsSync as _ } from "node:fs";

dist/graph-assets/vendor/elk.bundled.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/graph-assets/vendor/elk.bundled.jsView on unpkg