@jolli.ai/cli@0.99.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@jolli.ai/cli@0.99.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/McpServer.jsView file

467try { L468: m = await import(wn(c).href); L469: } catch (h) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/McpServer.jsView on unpkg · L467

46try { L47: const n = await H(e ?? Xe(), "utf-8"), t = JSON.parse(n); L48: if (!W(t) || typeof t.checkedAt != "string" || typeof t.ttlHours != "number" || !(t.ttlHours > 0) || !W(t.packages)) return null; ... L279: }; L280: if (process.env.JOLLI_NO_PLUGINS === "1") return { L281: known: n, ... L352: if (e?.rootsOverride) return e.rootsOverride; L353: const n = [], t = process.cwd(), o = Qe(t).root, i = e?.homedirOverride ?? bn(), s = ((p) => { L354: let m = p; ... L414: if (!c.isDirectory() && !c.isSymbolicLink()) continue; L415: const p = C(l, c.name), m = C(p, "package.json"); L416: if (!R(m)) continue;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/McpServer.jsView on unpkg · L46

dist/graph-assets/vendor/elk.bundled.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/graph-assets/vendor/elk.bundled.jsView on unpkg

dist/Logger.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jolli.ai/cli@0.99.13 matchedIdentity = npm:QGpvbGxpLmFpL2NsaQ:0.99.13 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/Logger.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 26-66json

26 "schemas/",

27 "README.md"

28 ],

29 "scripts": {

30 "all": "npm run clean && npm run build && npm run lint && npm run test",

31 "build": "vite build && tsc --project tsconfig.build.json",

32 "postbuild": "node -e \"require('fs').chmodSync('dist/Cli.js', 0o755)\"",

33 "clean": "rimraf dist/",

34 "typecheck": "tsc --noEmit",

35 "lint": "biome check --error-on-warnings",

36 "lint:fix": "biome check --write",

37 "cli": "tsx src/Cli.ts",

38 "cli:build": "npm run build && node dist/Cli.js",

39 "gen:telemetry-doc": "tsx scripts/gen-telemetry-doc.mjs",

40 "test": "vitest run --coverage",

41 "test:fast": "vitest run --mode fast --coverage --reporter=dot",

42 "test:slow": "vitest run --mode slow --reporter=dot",

43 "test:changed": "vitest run --changed origin/main --reporter=dot",

44 "test:watch": "vitest",

45 "test:acceptance": "vitest run --config vitest.acceptance.config.ts",

46 "postinstall": "node -e \"require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 },

48 "keywords": [

49 "ai",

50 "ai-agent",

51 "coding-agent",

52 "mcp",

53 "model-context-protocol",

54 "memory",

55 "documentation",

56 "git-hooks",

57 "claude-code",

58 "codex",

59 "gemini",

60 "opencode",

61 "kimi",

62 "cursor",

63 "copilot",

64 "cline",

65 "devin",

66 "antigravity",

dist/McpServer.jsView file

Lines 26-66javascript

26import { homedir as bn } from "node:os";

27import { existsSync as R } from "node:fs";

28import { fileURLToPath as yn, pathToFileURL as wn } from "node:url";

dist/graph-assets/vendor/elk.bundled.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/graph-assets/vendor/elk.bundled.jsView on unpkg

dist/Logger.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jolli.ai/cli@0.99.13 matchedIdentity = npm:QGpvbGxpLmFpL2NsaQ:0.99.13 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/Logger.jsView on unpkg