@kaos-intelligence/book-evolve: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@kaos-intelligence/book-evolve: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/web/server.jsView file

10import chalk from 'chalk'; L11: import { exec } from 'node:child_process'; L12: import { scaffoldProject, detectExistingProject } from '../cli/scaffold.js';

High

Child Process

Package source references child process execution.

dist/web/server.jsView on unpkg · L10

dist/cli/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kaos-intelligence/book-evolve@1.3.1 matchedIdentity = npm:[redacted]:1.3.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/doctor.jsView on unpkg

8import { join } from 'node:path'; L9: import { spawnSync } from 'node:child_process'; L10: import chalk from 'chalk'; ... L12: // is honored — module-import-time reads would race the file load. L13: const litellmUrl = () => process.env.LITELLM_BASE_URL || 'http://127.0.0.1:4000/v1'; L14: const ollamaUrl = () => process.env.OLLAMA_BASE_URL || 'http://127.0.0.1:11434';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/doctor.jsView on unpkg · L8

84? undefined L85: : 'Re-run: npx @kaos-intelligence/book-evolve scaffold --dir . --force', L86: }; ... L97: } L98: const result = spawnSync(venvPython, ['-c', 'import openai, yaml, jinja2, numpy, requests'], { encoding: 'utf-8', timeout: 30_000 }); L99: return {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/doctor.jsView on unpkg · L84

assets/pipeline/pipeline.tar.gzView file

•path = assets/pipeline/pipeline.tar.gz kind = high_entropy_blob sizeBytes = 76605 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/pipeline/pipeline.tar.gzView on unpkg

•path = assets/pipeline/pipeline.tar.gz kind = compressed_blob sizeBytes = 76605 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/pipeline/pipeline.tar.gzView on unpkg

Source & flagged code

6 flagged

dist/web/server.jsView file

Lines 1-30javascript

1/**

2 * Web-based onboarding UI.

3 *

4 * Starts a simple HTTP server at http://localhost:3010

5 * with a visual onboarding wizard. Scaffolds the project

6 * on form submission, then shuts down.

7 */

8import { createServer, } from 'node:http';

9import { join } from 'node:path';

10import chalk from 'chalk';

11import { exec } from 'node:child_process';

12import { scaffoldProject, detectExistingProject } from '../cli/scaffold.js';

High

Child Process

Package source references child process execution.

dist/web/server.jsView on unpkg · L10

13const PORT = 3010;

14export async function startWebUI(outputDir) {

15 // eslint-disable-next-line prefer-const — referenced inside its own handler

16 const server = createServer(async (req, res) => {

17 if (req.url === '/' || req.url === '/index.html') {

18 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });

19 res.end(getOnboardingHTML(outputDir));

20 }

21 else if (req.url === '/api/detect' && req.method === 'GET') {

22 // Let the frontend know if a project already exists

23 const existing = detectExistingProject(outputDir);

24 res.writeHead(200, { 'Content-Type': 'application/json' });

25 res.end(JSON.stringify({ exists: existing.exists, path: outputDir }));

26 }

27 else if (req.url === '/api/config' && req.method === 'POST') {

28 let body = '';

29 req.on('data', (chunk) => {

30 body += chunk.toString();

dist/cli/doctor.jsView file

Lines 1-28javascript

1/**

2 * Doctor — verifies a book-evolve project is fully provisioned and every

3 * dependency the evolution pipeline needs is reachable. Run before evolving;

4 * every failure includes the exact fix.

5 */

6import { existsSync, readdirSync, readFileSync } from 'node:fs';

7import { homedir } from 'node:os';

assets/pipeline/pipeline.tar.gzView file

•path = assets/pipeline/pipeline.tar.gz kind = high_entropy_blob sizeBytes = 76605 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/pipeline/pipeline.tar.gzView on unpkg

•path = assets/pipeline/pipeline.tar.gz kind = compressed_blob sizeBytes = 76605 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/pipeline/pipeline.tar.gzView on unpkg