@junyoung-kim/reins@0.1.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@junyoung-kim/reins@0.1.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/cli.mjsView file

10import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cli.mjsView on unpkg · L10

10import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.mjsView on unpkg · L10

10Trigger-reachable chain: scripts.start -> dist/cli.mjs L10: import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L10

2360// ../../[redacted]-detector.ts L2361: import { exec } from "child_process"; L2362: var log4 = createLogger("agent-detector");

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L2360

47function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L47

10import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L10

10Trigger-reachable persistence chain: scripts.start -> dist/cli.mjs L10: import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.mjsView on unpkg · L10

10import os from "os"; L11: var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs"); L12: function configureLogDir(dir) { ... L47: function createNodePty(opts) { L48: const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash"; L49: const proc = pty.spawn(shell, opts.args ?? [], { ... L58: proc.onData((data) => dataCallback?.(data)); L59: proc.onExit(({ exitCode }) => exitCallback?.(exitCode)); L60: return { ... L63: }, L64: write: (data) => proc.write(data), L65: resize: (cols, rows) => proc.resize(cols, rows),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L10

Source & flagged code

8 flagged

dist/cli.mjsView file

Lines 1-67javascript

1#!/usr/bin/env node

2

3// src/cli.tsx

4import os16 from "os";

5import path23 from "path";

6

7// ../../packages/core/src/lib/logger.ts

8import log from "electron-log/node.js";

9import path from "path";

10import os from "os";

11var scopedLogDir = path.join(os.homedir(), ".ai_remote_vibe_agent", "logs");

12function configureLogDir(dir) {

13 scopedLogDir = dir;

14}

15var loggers = [];

16var consoleEnabled = true;

17function setConsoleLogging(enabled) {

18 consoleEnabled = enabled;

19 for (const scoped of loggers) {

20 scoped.transports.console.level = enabled ? "silly" : false;

21 }

22}

23function createLogger(component) {

24 const scoped = log.create({ logId: component });

25 scoped.transports.file.fileName = `${component}.log`;

26 scoped.transports.file.resolvePathFn = () => path.join(scopedLogDir, `${component}.log`);

27 scoped.transports.file.format = "[{y}-{m}-{d} {h}:{i}:{s}.{ms}] [{level}] [{logId}] {text}";

28 scoped.transports.file.maxSize = 5 * 1024 * 1024;

29 scoped.transports.console.format = "[{h}:{i}:{s}.{ms}] [{level}] [{logId}] {text}";

30 loggers.push(scoped);

31 if (!consoleEnabled) scoped.transports.console.level = false;

32 return scoped;

33}

34

35// ../../packages/core/src/managers/ssh-manager.ts

36import { Client } from "ssh2";

37import fs2 from "fs";

38import os3 from "os";

39import path3 from "path";

40import crypto2 from "crypto";

41import { StringDecoder } from "string_decoder";

42import simpleGit from "simple-git";

43import pLimit from "p-limit";

44

45// ../../packages/core/src/managers/pty-manager.ts

46import pty from "node-pty";

47function createNodePty(opts) {

48 const shell = process.platform === "win32" ? opts.shell || process.env.COMSPEC || "cmd.exe" : opts.shell || process.env.SHELL || "/bin/bash";

49 const proc = pty.spawn(shell, opts.args ?? [], {

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L47

50 name: "xterm-256color",

51 cols: opts.cols,

52 rows: opts.rows,

53 cwd: opts.cwd,

54 env: opts.env

55 });

56 let dataCallback = null;

57 let exitCallback = null;

58 proc.onData((data) => dataCallback?.(data));

59 proc.onExit(({ exitCode }) => exitCallback?.(exitCode));

60 return {

61 get pid() {

62 return proc.pid;

63 },

64 write: (data) => proc.write(data),

65 resize: (cols, rows) => proc.resize(cols, rows),

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cli.mjsView on unpkg · L10

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.mjsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L10

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L10

66 kill: () => proc.kill(),

67 onData: (cb) => {

Lines 2340-2380javascript

2340 case "delete_branch":

2341 return `${cd} && git branch ${action.force ? "-D" : "-d"} ${JSON.stringify(action.branch)} 2>&1`