Loading npm security reports…

@linghun/tui@0.1.11: Clean npm security report (Allow) | LPM Firewall

registry / @linghun/tui / 0.1.11

@linghun/tui@0.1.11

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface. Runtime network, process, and file operations are feature-bound to explicit TUI commands and project-local Linghun state.

Static reason

No blocking static signals were detected.

Trigger

Importing alone has no active trigger; connector, verification, and configuration actions require TUI runtime/user command paths.

Impact

No unconsented persistence, credential exfiltration, destructive behavior, or foreign AI-agent control-surface mutation established.

Mechanism

User-invoked TUI orchestration, local connector requests, and verification command execution.

Rationale

Source inspection shows a feature-rich Linghun TUI with explicit runtime capabilities, but no lifecycle execution or concrete malicious chain. Network, environment, shell, and filesystem primitives are guarded by user/runtime command paths and package-owned project storage.

Evidence

package.jsondist/index.jsdist/chunk-RLC2V26Q.jsdist/chunk-ZNTRA4FN.jsdist/chunk-ZEC2L4XP.jsdist/chunk-DKAXTIFO.jsprojectPath/.linghunprojectPath/.linghun/permissions.json

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks or bin entrypoint.
dist/index.js exports runTui and helpers; it does not invoke runTui at import time.
dist/chunk-RLC2V26Q.js sends HTTP only after explicit /apps connector actions using a project-local manifest.
dist/chunk-ZNTRA4FN.js runs verification commands during the TUI's explicit verification workflow and records logs.
dist/chunk-ZEC2L4XP.js writes only Linghun permission state under projectPath/.linghun.
No hard-coded non-example network endpoint, credential exfiltration path, foreign agent-config mutation, eval, or remote payload loader was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 355 file(s), 2.80 MB of source, external domains: example.com, github.com

Source & flagged code

1 flagged

dist/chunk-ORR2P35Y.jsView file

Lines 231-271javascript

231 if (!reason) return void 0;

232 const parts = reason.split(";").filter(

233 (part) => part.startsWith("generatedEvidence=") || part === "generatedVerification=partial" || part === "index=unknown_nonblocking"

234 );

235 return parts.length > 0 ? parts.join(";") : void 0;

236}

237function deriveAgentDisplayName(type, task) {

238 const stopWords = /* @__PURE__ */ new Set([

239 "a",

240 "an",

241 "and",

242 "for",

243 "help",

244 "job",

245 "please",

246 "run",

247 "task",

248 "the",

249 "to",

250 "with"

251 ]);

252 const asciiTask = Array.from(task.normalize("NFKD").toLowerCase()).map((char) => char.charCodeAt(0) <= 127 ? char : " ").

253 const tokens = asciiTask.replace(/[^a-z0-9]+/gu, " ").trim().split(/\s+/u).filter((token) => token &&

254 const base = tokens.length > 0 ? tokens.join("-") : `task-${createHash("sha1").update(task).digest("hex").slice(

255 const label = base.endsWith(`-${type}`) ? base : `${base}-${type}`;

256 return truncateAsciiLabel(label, 36);

257}

258function truncateAsciiLabel(value, maxLength) {

259 const cleaned = value.replace(/[^a-z0-9-]/gu, "-").replace(/-{2,}/gu, "-").replace(/^-|-$/gu, "");

260 if (cleaned.length <= maxLength) {

261 return cleaned || "agent";

262 }

263 return cleaned.slice(0, maxLength).replace(/-+$/u, "") || "agent";

264}

265function createDurableJobAgents(options, status, runningCap) {

266 const total = Math.max(1, options.requestedAgents);

267 const tasks = createDurableJobAgentTasks(options.goal, total);

268 return Array.from({ length: total }, (_, index) => {

269 const active = false;

270 const agentStatus = status === "running" ? index < runningCap ? "queued" : "sleeping" : status === "created" ? "created" : status;

271 const type = index === 0 ? "planner" : index === 1 ? "worker" : index === 2 ? "verifier" :

Source & flagged code

1 flagged · loading source

dist/chunk-ORR2P35Y.jsView file

251]); L252: const asciiTask = Array.from(task.normalize("NFKD").toLowerCase()).map((char) => char.charCodeAt(0) <= 127 ? char : " ").join(""); L253: const tokens = asciiTask.replace(/[^a-z0-9]+/gu, " ").trim().split(/\s+/u).filter((token) => token && !stopWords.has(token)).slice(0, 3);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-ORR2P35Y.jsView on unpkg · L251

Findings

2 Medium5 Low

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/chunk-ORR2P35Y.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings