registry / @lineman-io/plugin / 2.9.26

@lineman-io/plugin@2.9.26

Lineman MCP server — AI-powered code intelligence for Claude Code

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 96 file(s), 606 KB of source, external domains: api-app-staging.lineman.io, api-app.lineman.io, api-data-staging.lineman.io, api-data.lineman.io, api.lineman.io, lineman.io, nodejs.org

Oversized source lightweight scan

dist/main.js2.13 MB file, sampled 256 KB

NetworkDynamicRequireObfuscatedHighEntropyStringsMinified

Source & flagged code

5 flagged

start.mjsView file

Lines 13-35javascript

13process.env.LINEMAN_PROJECT_DIR = process.env.LINEMAN_PROJECT_DIR ?? originalCwd;

15// chdir to the plugin root so our own node_modules resolves reliably, even

16// when Claude Code's versioned plugin cache path is used

17// (~/.claude/plugins/cache/<org>/<plugin>/<version>/).

18process.chdir(__dirname);

20// Log the versioned cache path, if we appear to be running from one — helps

21// diagnose stale-install issues without self-healing yet.

22const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT ?? __dirname;

23const cacheMatch = pluginRoot.match(/plugins\/cache\/([^/]+)\/([^/]+)\/([^/]+)/);

24if (cacheMatch) {

25 process.stderr.write(

26 `[lineman] plugin cache: org=${cacheMatch[1]} plugin=${cacheMatch[2]} version=${cacheMatch[3]}\n`,

27 );

28}

30// Hand off to the compiled server entry. LIN-1724 — on Windows a bare absolute

31// path (`D:\...\dist\main.js`) is not a valid ESM specifier

32// (ERR_UNSUPPORTED_ESM_URL_SCHEME, "protocol 'd:'"), so the dynamic import must

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX.

34await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/image-compress.mjsView file

Lines 1-1javascript

1import{createHash as t}from"node:crypto";import{mkdirSync as e,readdirSync as i,statSync as n,unlinkSync as o}from"node:fs";import{writeFile as r}from"node:fs/promises";import{tmpdir as s}from"node:os";import{join as c}from"node:path"

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2228646 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2228646 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

hooks/stop.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lineman-io/plugin@2.9.24 matchedIdentity = npm:QGxpbmVtYW4taW8vcGx1Z2lu:2.9.24 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/stop.mjsView on unpkg

Source & flagged code

5 flagged · loading source

start.mjsView file

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX. L34: await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/image-compress.mjsView file

1import{createHash as t}from"node:crypto";import{mkdirSync as e,readdirSync as i,statSync as n,unlinkSync as o}from"node:fs";import{writeFile as r}from"node:fs/promises";import{tmpd...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/core/image-compress.mjsView on unpkg · L1

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2228646 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2228646 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

hooks/stop.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/stop.mjsView on unpkg

Findings

3 High5 Medium6 Low

HighObfuscated

HighOversized Source Filedist/main.js

HighPrevious Version Dangerous Deltahooks/stop.mjs

MediumDynamic Requirestart.mjs

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/main.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptohooks/core/image-compress.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

start.mjsView file

Lines 13-35javascript

13process.env.LINEMAN_PROJECT_DIR = process.env.LINEMAN_PROJECT_DIR ?? originalCwd;

15// chdir to the plugin root so our own node_modules resolves reliably, even

16// when Claude Code's versioned plugin cache path is used

17// (~/.claude/plugins/cache/<org>/<plugin>/<version>/).

18process.chdir(__dirname);

20// Log the versioned cache path, if we appear to be running from one — helps

21// diagnose stale-install issues without self-healing yet.

22const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT ?? __dirname;

23const cacheMatch = pluginRoot.match(/plugins\/cache\/([^/]+)\/([^/]+)\/([^/]+)/);

24if (cacheMatch) {

25 process.stderr.write(

26 `[lineman] plugin cache: org=${cacheMatch[1]} plugin=${cacheMatch[2]} version=${cacheMatch[3]}\n`,

27 );

28}

30// Hand off to the compiled server entry. LIN-1724 — on Windows a bare absolute

31// path (`D:\...\dist\main.js`) is not a valid ESM specifier

32// (ERR_UNSUPPORTED_ESM_URL_SCHEME, "protocol 'd:'"), so the dynamic import must

33// be a file:// URL. pathToFileURL is a no-op-equivalent on POSIX.

34await import(pathToFileURL(resolve(__dirname, "dist", "main.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.mjsView on unpkg · L33

hooks/core/image-compress.mjsView file

Lines 1-1javascript

dist/main.jsView file

•path = dist/main.js kind = oversized_source_file sizeBytes = 2228646 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.jsView on unpkg

•path = dist/main.js kind = oversized_cli_entrypoint sizeBytes = 2228646 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.jsView on unpkg

hooks/stop.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/stop.mjsView on unpkg