@kdrrr/overcast@0.0.15: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@kdrrr/overcast@0.0.15: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/brand-pi.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/extension/overcast.jsView file

87if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/extension/overcast.jsView on unpkg · L87

87Trigger-reachable chain: manifest.exports -> dist/extension/overcast.js L87: if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/extension/overcast.jsView on unpkg · L87

207import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/extension/overcast.jsView on unpkg · L207

87Cross-file remote execution chain: dist/extension/overcast.js spawns dist/bin/overcast.js; helper contains network access plus dynamic code execution. L87: if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extension/overcast.jsView on unpkg · L87

3234if (!choice) return { kind: "unavailable", reason: "no brain LLM is configured (set one with `setup llm`, or provide a Cloudglue key)" }; L3235: const { builtinModels } = await import("@earendil-works/pi-ai/providers/all"); L3236: const models = builtinModels();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extension/overcast.jsView on unpkg · L3234

87if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extension/overcast.jsView on unpkg · L87

examples/providers/sources/mcp-bridge.tsView file

59const re = /"([^"]*)"|'([^']*)'|(\S+)/g; L60: let m: RegExpExecArray | null; L61: while ((m = re.exec(s)) !== null) out.push(m[1] ?? m[2] ?? m[3]);

High

Shell

Package source references shell execution.

examples/providers/sources/mcp-bridge.tsView on unpkg · L59

providers/engines/screenshot/render.mjsView file

17// assertFetchHostAllowed guard entirely — so this script re-implements the same L18: // policy (ported predicates from src/media/fetch.ts): block localhost, private/ L19: // loopback/link-local/CGNAT IPv4 in every inet_aton encoding, IPv6 ULA/link- ... L29: import { pathToFileURL, fileURLToPath } from "node:url"; L30: import { lookup } from "node:dns/promises"; L31: // Chromium binary resolution (override → playwright default → the build actually ... L193: function allowPrivate() { L194: const v = (process.env.OVERCAST_ALLOW_PRIVATE_FETCH ?? "").trim().toLowerCase(); L195: return v === "1" || v === "true" || v === "yes" || v === "on"; ... L269: killBrowserSync(); L270: process.stderr.write(`${msg}\n`); L271: process.exit(code);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

providers/engines/screenshot/render.mjsView on unpkg · L17

providers/engines/screenshot/screenshot.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

providers/engines/screenshot/screenshot.shView on unpkg

assets/branding/sting.m4aView file

•path = assets/branding/sting.m4a kind = high_entropy_blob sizeBytes = 83043 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/branding/sting.m4aView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 56-96json

56 "build": "tsup && npm run build:web",

57 "build:web": "vite build --config web/chair/vite.config.ts && vite build --config web/situation/vite.config.ts",

58 "dev:web": "vite --config web/chair/vite.config.ts",

59 "dev:web:situation": "vite --config web/situation/vite.config.ts",

60 "typecheck": "tsc --noEmit && tsc -p web/chair --noEmit && tsc -p web/situation --noEmit",

61 "test": "node --test --import tsx test/unit/*.test.ts",

62 "test:e2e": "bash test/e2e/run.sh",

63 "test:e2e:live": "bash test/e2e/live/run.sh",

64 "e2e:media": "bash scripts/fetch-e2e-media.sh",

65 "dev:setup": "bash scripts/setup-dev.sh",

66 "dev:clean": "bash scripts/clean-dev.sh",

67 "build:bun": "npm run build:web && bun build --compile bin/overcast.ts --outfile dist/bin/overcast && node scripts/bun-sidecar.mjs",

68 "build:vscode": "npm --prefix vscode run build",

69 "typecheck:vscode": "npm --prefix vscode run typecheck",

70 "dev": "tsx bin/overcast.ts",

71 "sync-version": "node scripts/sync-version.mjs",

72 "pack:check": "node scripts/sync-version.mjs --check && node scripts/check-dist-fresh.mjs",

73 "version": "node scripts/sync-version.mjs && git add -A src/version.ts .claude-plugin/plugin.json .claude-plugin/marketplace.json vscode/package.json vscode/package-lock.json",

74 "prepack": "npm run pack:check",

75 "prepublishOnly": "npm run build",

76 "postinstall": "node scripts/brand-pi.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

77 "brand": "node scripts/brand-pi.mjs"

78 },

79 "dependencies": {

80 "@earendil-works/pi-agent-core": "0.82.1",

81 "@earendil-works/pi-ai": "0.82.1",

82 "@earendil-works/pi-coding-agent": "0.82.1",

83 "@earendil-works/pi-tui": "0.82.1",

84 "zod": "^4.4.3"

85 },

86 "devDependencies": {

87 "@types/node": "^26.1.1",

88 "tsup": "^8.3.5",

89 "tsx": "^4.19.2",

90 "typescript": "^7.0.2",

91 "vite": "^8.1.3"

92 },

93 "optionalDependencies": {

94 "playwright": "^1.61.1"

95 },

96 "overrides": {

dist/extension/overcast.jsView file

87if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/extension/overcast.jsView on unpkg · L87

87Trigger-reachable chain: manifest.exports -> dist/extension/overcast.js L87: if (typeof v === "string") { L88: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(stripUrlTail(v)) && VISUAL_KEY_RE.test(key)) refs.add(v); L89: return; ... L187: try { L188: out.push(JSON.parse(t)); L189: } catch { ... L207: import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto"; ... L215: function resolveTool(envVar, bin) { L216: const override = process.env[envVar]; L217: if (override && existsSync2(override)) return override;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/extension/overcast.jsView on unpkg · L87

207import { tmpdir } from "os"; L208: import { execFile } from "child_process"; L209: import { createHash } from "crypto";

examples/providers/sources/mcp-bridge.tsView file

Lines 39-79typescript

39import { createWriteStream, unlink } from "node:fs";

40import { createHash } from "node:crypto";

41import { get as httpsGet } from "node:https";

42import { get as

providers/engines/screenshot/render.mjsView file

Lines 1-37javascript

1// overcast screenshot engine — headless Chromium page render via Playwright.

2// The ONE renderer behind both browser-capture surfaces: the `screenshot` verb

3// (screenshot.sh run) and the `browser:` source (browser.sh fetch). Runs under

4// system `node` (never inside the bun binary): `playwright` is an OPTIONAL npm

5// dep resolved from this script's own location, so a missing install degrades

6// to exit 13 (the exec-contract "missing deps" code → needs_credentials).

7//

8// node render.mjs --emit record --input <url|path.html> [--out <png>]

9// [--full-page] [--viewport WxH] [--wait ms] [--timeout ms]

providers/engines/screenshot/screenshot.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

providers/engines/screenshot/screenshot.shView on unpkg

assets/branding/sting.m4aView file

•path = assets/branding/sting.m4a kind = high_entropy_blob sizeBytes = 83043 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/branding/sting.m4aView on unpkg