@kurumera/cli@0.9.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@kurumera/cli@0.9.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/util/keychain.jsView file

1import { execFileSync } from "node:child_process"; L2: /**

High

Child Process

Package source references child process execution.

dist/util/keychain.jsView on unpkg · L1

4* platform — macOS Keychain (`security`), Windows Credential Manager L5: * (PowerShell `CredentialManager` cmdlets, falling back to `cmdkey` for L6: * read-back availability checks), Linux Secret Service (`secret-tool`).

High

Shell

Package source references shell execution.

dist/util/keychain.jsView on unpkg · L4

dist/commands/preview.jsView file

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/preview.jsView on unpkg · L1

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { L6: try { L7: if (process.platform === "win32") { L8: spawn("cmd", ["/c", "start", "", url.replace(/&/g, "^&")], { stdio: "ignore", detached: true, windowsVerbatimArguments: true }).unref(); ... L26: const authToken = await resolveAuthToken(); L27: process.stdout.write("Waiting for the build"); L28: let previewUrl = ""; ... L35: const r = await fetch(`${PUSH_URL}/status?store=${encodeURIComponent(store)}`, { headers: authToken ? { Authorization: `Bearer ${authToken}` } : {} });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/preview.jsView on unpkg · L1

dist/commands/preview.js#virtual:normalized:round1View file

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { ... L15: /** L16: * `kurumera theme preview` — poll the latest pushed build; when it"s ready, open\n * the preview URL (the theme rendered against a live store, unpublished).\n */\nexport async func... L17: if (s.status === "idle" || !s.status) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/preview.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin.js -> dist/commands/preview.js L1: import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { ... L15: /** L16: * `kurumera theme preview` — poll the latest pushed build; when it"s ready, open\n * the preview URL (the theme rendered against a live store, unpublished).\n */\nexport async func... L17: if (s.status === "idle" || !s.status) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/commands/preview.js#virtual:normalized:round1View on unpkg · L1

dist/commands/checkpoint.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kurumera/cli@0.1.14 matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.1.14 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/checkpoint.jsView on unpkg

Source & flagged code

7 flagged

dist/util/keychain.jsView file

Lines 1-24javascript

1import { execFileSync } from "node:child_process";

2/**

High

Child Process

Package source references child process execution.

dist/util/keychain.jsView on unpkg · L1

3 * Best-effort OS keychain / credential-manager backup for the current

4 * platform — macOS Keychain (`security`), Windows Credential Manager

5 * (PowerShell `CredentialManager` cmdlets, falling back to `cmdkey` for

6 * read-back availability checks), Linux Secret Service (`secret-tool`).

High

Shell

Package source references shell execution.

dist/util/keychain.jsView on unpkg · L4

7 *

8 * Deliberately NOT a `keytar`-style native-binding npm dependency: this

9 * package has zero runtime dependencies by design, and the actual target

10 * environment for this CLI's remote-safe auth work is an ephemeral,

11 * frequently-headless AI-agent sandbox (see AUTHENTICATION.md) — those have

12 * no OS keychain at all, and a native binding is a real fragility risk for

13 * something that must `npx`-install cleanly there. So this module only ever

14 * helps the SEPARATE "local developer machine" case (item 11's "otherwise

15 * use OS keychain locally"), and only when a supported platform tool is

16 * actually present.

17 *

18 * Current integration depth: a best-effort, redundant BACKUP of the saved

19 * session, written alongside the existing 0600 `~/.kurumera/config.json`

20 * (which remains authoritative and unchanged) — not yet consulted as a read

21 * source by resolveAuthToken.ts. That file is already correct and simple;

22 * this exists so a user who loses `~/.kurumera` (a wiped home directory, a

23 * fresh container) can recover a LOCAL loopback-flow session without

24 * re-authenticating, via `readFromKeychain()`, called explicitly rather than

dist/commands/preview.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { readConfig } from "../util/config.js";

3import { resolveAuthToken } from "../util/resolveAuthToken.js";

4const PUSH_URL = (process.env.

dist/commands/preview.js#virtual:normalized:round1View file

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { ... L15: /** L16: * `kurumera theme preview` — poll the latest pushed build; when it"s ready, open\n * the preview URL (the theme rendered against a live store, unpublished).\n */\nexport async func... L17: if (s.status === "idle" || !s.status) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/preview.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin.js -> dist/commands/preview.js L1: import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { ... L15: /** L16: * `kurumera theme preview` — poll the latest pushed build; when it"s ready, open\n * the preview URL (the theme rendered against a live store, unpublished).\n */\nexport async func... L17: if (s.status === "idle" || !s.status) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/commands/preview.js#virtual:normalized:round1View on unpkg · L1

dist/commands/checkpoint.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kurumera/cli@0.1.14 matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.1.14 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/checkpoint.jsView on unpkg