registry / @lineman-io/plugin / 2.9.19

@lineman-io/plugin@2.9.19

Lineman MCP server — AI-powered code intelligence for Claude Code

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 92 file(s), 590 KB of source, external domains: api-app-staging.lineman.io, api-app.lineman.io, api-data-staging.lineman.io, api-data.lineman.io, api.lineman.io, auth.lineman.io, disabled.invalid, lineman.io, nodejs.org

Oversized source lightweight scan

dist/main.js2.09 MB file, sampled 256 KB

NetworkDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsauth.lineman.iodisabled.invalid

Source & flagged code

4 flagged

start.mjsView file

Lines 13-35javascript

13process.env.LINEMAN_PROJECT_DIR = process.env.LINEMAN_PROJECT_DIR ?? originalCwd;

15// chdir to the plugin root so our own node_modules resolves reliably, even

16// when Claude Code's versioned plugin cache path is used

17// (~/.claude/plugins/cache/<org>/<plugin>/<version>/).

18process.chdir(__dirname);

20// Log the versioned cache path, if we appear to be running from one — helps

21// diagnose stale-install issues without self-healing yet.

22const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT ?? __dirname;

23const cacheMatch = pluginRoot.match(/plugins\/cache\/([^/]+)\/([^/]+)\/([^/]+)/);

24if (cacheMatch) {

25 process.stderr.write(

26 `[lineman] plugin cache: org=${cacheMatch[1]} plugin=${cacheMatch[2]} version=${cacheMatch[3]}\n`,

27 );

28}

30// Hand off to the compiled server entry. LIN-1724 — on Windows a bare absolute

31// path (`D:\...\dist\main.js`) is not a valid ESM specifier

32// (ERR_UNSUPPORTED_ESM_URL_SCHEME, "protocol 'd:'"), so the dynamic import must

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX.

34await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/tier3-transport.mjsView file

Lines 1-1javascript

1import{createHash as e}from"node:crypto";import{platform as r}from"node:os";export function tier3TransportTarget(t){return"win32"===r()?`\\\\.\\pipe\\lineman-tier3-${e("sha1").update

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2196233 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2196233 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

Source & flagged code

4 flagged · loading source

start.mjsView file

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX. L34: await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/tier3-transport.mjsView file

1import{createHash as e}from"node:crypto";import{platform as r}from"node:os";export function tier3TransportTarget(t){return"win32"===r()?`\\\\.\\pipe\\lineman-tier3-${e("sha1").upda...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/core/tier3-transport.mjsView on unpkg · L1

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2196233 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2196233 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

Findings

2 High5 Medium6 Low

HighObfuscated

HighOversized Source Filedist/main.js

MediumDynamic Requirestart.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/main.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptohooks/core/tier3-transport.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

start.mjsView file

Lines 13-35javascript

13process.env.LINEMAN_PROJECT_DIR = process.env.LINEMAN_PROJECT_DIR ?? originalCwd;

15// chdir to the plugin root so our own node_modules resolves reliably, even

16// when Claude Code's versioned plugin cache path is used

17// (~/.claude/plugins/cache/<org>/<plugin>/<version>/).

18process.chdir(__dirname);

20// Log the versioned cache path, if we appear to be running from one — helps

21// diagnose stale-install issues without self-healing yet.

22const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT ?? __dirname;

23const cacheMatch = pluginRoot.match(/plugins\/cache\/([^/]+)\/([^/]+)\/([^/]+)/);

24if (cacheMatch) {

25 process.stderr.write(

26 `[lineman] plugin cache: org=${cacheMatch[1]} plugin=${cacheMatch[2]} version=${cacheMatch[3]}\n`,

27 );

28}

30// Hand off to the compiled server entry. LIN-1724 — on Windows a bare absolute

31// path (`D:\...\dist\main.js`) is not a valid ESM specifier

32// (ERR_UNSUPPORTED_ESM_URL_SCHEME, "protocol 'd:'"), so the dynamic import must

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX.

34await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/tier3-transport.mjsView file

Lines 1-1javascript

1import{createHash as e}from"node:crypto";import{platform as r}from"node:os";export function tier3TransportTarget(t){return"win32"===r()?`\\\\.\\pipe\\lineman-tier3-${e("sha1").update

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2196233 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2196233 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg