@lark-codem/codem-core-darwin-x64: Suspicious npm security report

Loading npm security reports…

@lark-codem/codem-core-darwin-x64: Suspicious npm security report | LPM Firewall

Source & flagged code

3 flagged

package.jsonView file

Lines 1-24json

2 "name": "@lark-codem/codem-core-darwin-x64",

3 "version": "0.7.68",

4 "description": "Platform-specific CodeM binary for darwin-x64.",

5 "license": "SEE LICENSE IN LICENSE",

6 "os": [

7 "darwin"

8 ],

9 "cpu": [

10 "x64"

11 ],

12 "scripts": {

13 "postinstall": "node -e \"var f=require('path').join(__dirname,'codem-core'),fs=require('fs');try{fs.chmodSync(f,0o755)}catch(e){};if(process.platform==='darwin'){['com.apple.quarantine','com.apple.provenance'].forEach(function(a){try{require('child_process').execFileSync('xattr',['-d',a,f],{stdio:'ignore'})}catch(e){}})}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L13

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 },

15 "files": [

16 "codem-core",

17 "LICENSE"

18 ],

19 "publishConfig": {

20 "registry": "https://registry.npmjs.org",

21 "access": "public"

22 }

23}

codem-coreView file

•path = codem-core kind = native_binary sizeBytes = 13700560 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codem-coreView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "var f=require('path').join(__dirname,'codem-core'),fs=require('fs');try{fs.chmodSync(f,0o755)}catch(e){};if(process.platform==='darwin'){['com.apple.quarantine','com.apple...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

codem-coreView file

•path = codem-core kind = native_binary sizeBytes = 13700560 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

codem-coreView on unpkg

@lark-codem/codem-core-darwin-x64@0.7.68

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code