@jun133/kitty@4.0.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@jun133/kitty@4.0.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-LYXFW33Y.mjsView file

1264`).run({ ...input, beforeHash: input.beforeHash ?? null, now }); L1265: const existing = this.require(input.turnId, input.callId); L1266: if (existing.sessionId !== input.sessionId || existing.toolName !== input.toolName || existing.argumentsJson !== input.argumentsJson || existing.effect !== input.effect) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-LYXFW33Y.mjsView on unpkg · L1264

dist/tui.mjsView file

53L54: // src/utils/execa.ts L55: async function loadExeca() { ... L95: ); L96: const commonGitDir = result.stdout.trim(); L97: if (!commonGitDir) { ... L180: async function readPackageScripts(rootDir) { L181: const packagePath = path2.join(rootDir, "package.json"); L182: const raw = await fs2.readFile(packagePath, "utf8").catch(() => void 0); ... L185: } L186: const parsed = JSON.parse(raw); L187: return Object.entries(parsed.scripts ?? {}).filter(([, value]) => typeof value === "string").map(([name]) => name).sort((left, right) => left.localeCompare(right));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.mjsView on unpkg · L53

dist/web/vendor/fonts/bootstrap-icons.woff2View file

•path = dist/web/vendor/fonts/bootstrap-icons.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/vendor/fonts/bootstrap-icons.woff2View on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 11185144 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 11185144 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 22-62json

22 "scripts/postinstall.cjs"

23 ],

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=22.13.0"

29 },

30 "scripts": {

31 "build": "node scripts/build.mjs",

32 "check": "npm run typecheck && npm run build && npm run check:package",

33 "check:package": "node scripts/verify-package.mjs",

34 "dev": "npm run build --silent && node dist/cli.js",

35 "test:build": "node -e \"require('node:fs').rmSync('.test-build', { recursive: true, force: true })\" && tsc -p tsconfig.tests.json",

36 "test:core": "npm run test:build && node scripts/run-tests.mjs core",

37 "test:eval": "npm run test:build && node scripts/run-tests.mjs evaluation",

38 "eval:local": "npm run test:build && node .test-build/scripts/run-evaluation.js local",

39 "eval:production": "npm run test:build && node .test-build/scripts/run-evaluation.js production",

40 "verify": "npm test",

41 "typecheck": "tsc --noEmit",

42 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "prepack": "npm run build",

44 "test": "npm run check && npm run test:core"

45 },

46 "dependencies": {

47 "@openilink/openilink-sdk-node": "^0.6.0",

48 "bootstrap": "^5.3.8",

49 "bootstrap-icons": "^1.13.1",

50 "chalk": "^5.6.2",

51 "commander": "^14.0.1",

52 "diff": "^8.0.2",

53 "docx": "^9.7.1",

54 "dotenv": "^17.2.3",

55 "execa": "^9.6.0",

56 "fast-glob": "^3.3.3",

57 "figlet": "^1.11.0",

58 "ink": "^7.1.0",

59 "mammoth": "^1.12.0",

60 "marked": "^15.0.7",

61 "openai": "^6.4.0",

62 "pdfjs-dist": "^6.1.200",

dist/chunk-LYXFW33Y.mjsView file

Lines 1244-1284javascript

1244 finishedAt: row.finished_at ?? void 0

1245 };

1246}

1247

1248// src/control/toolCalls.ts

1249var ToolCallLedgerRepo = class {

1250 constructor

dist/tui.mjsView file

53L54: // src/utils/execa.ts L55: async function loadExeca() { ... L95: ); L96: const commonGitDir = result.stdout.trim(); L97: if (!commonGitDir) { ... L180: async function readPackageScripts(rootDir) { L181: const packagePath = path2.join(rootDir, "package.json"); L182: const raw = await fs2.readFile(packagePath, "utf8").catch(() => void 0); ... L185: } L186: const parsed = JSON.parse(raw); L187: return Object.entries(parsed.scripts ?? {}).filter(([, value]) => typeof value === "string").map(([name]) => name).sort((left, right) => left.localeCompare(right));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.mjsView on unpkg · L53

dist/web/vendor/fonts/bootstrap-icons.woff2View file

•path = dist/web/vendor/fonts/bootstrap-icons.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/vendor/fonts/bootstrap-icons.woff2View on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 11185144 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 11185144 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg