Loading npm security reports…

@liumir/lmcode@0.9.16: Suspicious npm security report (Warn) | LPM Firewall

registry / @liumir/lmcode / 0.9.16

@liumir/lmcode@0.9.16

A terminal-native AI agent for builders

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 1.99 MB of source, external domains: api.deepseek.com, api.github.com, developer.mozilla.org, docs.expo.dev, dom.spec.whatwg.org, fetch.spec.whatwg.org, gitforwindows.org, github.com, html.spec.whatwg.org, jimmy.warting.se, storage.googleapis.com, w3c.github.io, www.apache.org, www.w3.org

Oversized source lightweight scan

dist/src-BWQTR-Q_.mjs3.94 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsdocs.expo.devgitforwindows.org

dist/typescript-bYZQXkZW.mjs

Source & flagged code

10 flagged

package.jsonView file

Lines 33-74json

33 "type": "module",

34 "imports": {

35 "#/*": [

36 "./src/*.ts",

37 "./src/*/index.ts"

38 ]

39 },

40 "publishConfig": {

41 "access": "public"

42 },

43 "scripts": {

44 "build": "tsdown",

45 "dev": "node scripts/dev.mjs",

46 "dev:cli-only": "tsx --import ../../build/register-raw-text-loader.mjs ./src/main.ts",

47 "dev:prod": "node dist/main.mjs",

48 "clean": "rm -rf dist",

49 "typecheck": "tsc -p tsconfig.json --noEmit",

50 "test": "pnpm -w run build:packages && vitest run",

51 "e2e": "pnpm -w run build:packages && LMCODE_E2E=1 vitest run test/e2e",

52 "e2e:real": "pnpm -w run build:packages && LMCODE_E2E_REAL=1 vitest run test/e2e/real-llm-smoke.e2e.test.ts",

53 "preinstall": "node -e \"console.log('\\n📦 正在安装 lmcode，请稍候...\\n')\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "postinstall": "node scripts/postinstall.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "smoke": "node dist/main.mjs --version"

56 },

57 "dependencies": {

58 "@earendil-works/pi-tui": "^0.78.1",

59 "@mariozechner/clipboard": "^0.3.2",

60 "chalk": "^5.4.1",

61 "cli-highlight": "^2.1.11",

62 "commander": "^13.1.0",

63 "diff": "^8.0.4",

64 "semver": "^7.7.4",

65 "smol-toml": "^1.6.1",

66 "zod": "^4.3.6"

67 },

68 "devDependencies": {

69 "@lmcode-cli/agent-core": "workspace:^",

70 "@lmcode-cli/config": "workspace:^",

71 "@lmcode-cli/lmcode-sdk": "workspace:^",

72 "@lmcode-cli/migration-legacy": "workspace:^",

73 "@lmcode/memory": "workspace:*",

74 "@modelcontextprotocol/sdk": "^1.29.0",

dist/esm-4IzxhvVw.mjsView file

Lines 5490-5530javascript

5490//#endregion

5491//#region ../../node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5492/**

5493* Aliases are pseudos that are expressed as selectors.

5494*/

5495const aliases = {

5496 "any-link": ":is(a, area, link)[href]",

5497

dist/plugin-run-node-DwlY9TkG.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';

3import { dirname as __cjsShimDirname } from 'node:path';

4const __filename = __cjsShimFileURLToPath

dist/version-41j2IADg.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';

3import { dirname as __cjsShimDirname } from 'node:path';

4const __filename = __cjsShimFileURLToPath

dist/run-shell-CPlOOTsM.mjsView file

4const __filename = __cjsShimFileURLToPath(import.meta.url); L5: const __dirname = __cjsShimDirname(__filename); L6: import { a as LMCODE_DATA_DIR_NAME, d as PRODUCT_NAME, i as LMCODE_CDN_LATEST_URL, r as DEFAULT_OAUTH_PROVIDER_NAME, t as CLI_UI_MODE } from "./app-DVsJE1fY.mjs"; ... L15: import path, { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path"; L16: import * as childProcess from "node:child_process"; L17: import { exec, execFile, execSync, spawn, spawnSync } from "node:child_process"; ... L588: if (argumentsText.length <= 65536 && previewText.trimEnd().endsWith("}")) try { L589: const parsed = JSON.parse(previewText); L590: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed; ... L1526: if (wire === void 0) return; L1527: const baseUrl = await promptTextInput(host, "输入服务商 API 地址", { subtitle: "例如 https://api.deepseek.com（可粘贴）" }); L1528: if (baseUrl === void 0) return;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/run-shell-CPlOOTsM.mjsView on unpkg · L4

icon.icoView file

•path = icon.ico kind = high_entropy_blob sizeBytes = 52489 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

icon.icoView on unpkg

dist/src-BWQTR-Q_.mjsView file

•path = dist/src-BWQTR-Q_.mjs kind = oversized_source_file sizeBytes = 4126719 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src-BWQTR-Q_.mjsView on unpkg

•path = dist/src-BWQTR-Q_.mjs kind = oversized_cli_entrypoint sizeBytes = 4126719 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/src-BWQTR-Q_.mjsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "console.log('\n📦 正在安装 lmcode，请稍候...\n')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node -e "console.log('\n📦 正在安装 lmcode，请稍候...\n')"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/esm-4IzxhvVw.mjsView file

Findings

3 High9 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobicon.ico

HighOversized Source Filedist/src-BWQTR-Q_.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/esm-4IzxhvVw.mjs

MediumDynamic Requiredist/plugin-run-node-DwlY9TkG.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/run-shell-CPlOOTsM.mjs

MediumOversized Cli Entrypointdist/src-BWQTR-Q_.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

Source & flagged code

10 flagged

package.jsonView file

Lines 33-74json

33 "type": "module",

34 "imports": {

35 "#/*": [

36 "./src/*.ts",

37 "./src/*/index.ts"

38 ]

39 },

40 "publishConfig": {

41 "access": "public"

42 },

43 "scripts": {

44 "build": "tsdown",

45 "dev": "node scripts/dev.mjs",

46 "dev:cli-only": "tsx --import ../../build/register-raw-text-loader.mjs ./src/main.ts",

47 "dev:prod": "node dist/main.mjs",

48 "clean": "rm -rf dist",

49 "typecheck": "tsc -p tsconfig.json --noEmit",

50 "test": "pnpm -w run build:packages && vitest run",

51 "e2e": "pnpm -w run build:packages && LMCODE_E2E=1 vitest run test/e2e",

52 "e2e:real": "pnpm -w run build:packages && LMCODE_E2E_REAL=1 vitest run test/e2e/real-llm-smoke.e2e.test.ts",

53 "preinstall": "node -e \"console.log('\\n📦 正在安装 lmcode，请稍候...\\n')\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "postinstall": "node scripts/postinstall.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "smoke": "node dist/main.mjs --version"

56 },

57 "dependencies": {

58 "@earendil-works/pi-tui": "^0.78.1",

59 "@mariozechner/clipboard": "^0.3.2",

60 "chalk": "^5.4.1",

61 "cli-highlight": "^2.1.11",

62 "commander": "^13.1.0",

63 "diff": "^8.0.4",

64 "semver": "^7.7.4",

65 "smol-toml": "^1.6.1",

66 "zod": "^4.3.6"

67 },

68 "devDependencies": {

69 "@lmcode-cli/agent-core": "workspace:^",

70 "@lmcode-cli/config": "workspace:^",

71 "@lmcode-cli/lmcode-sdk": "workspace:^",

72 "@lmcode-cli/migration-legacy": "workspace:^",

73 "@lmcode/memory": "workspace:*",

74 "@modelcontextprotocol/sdk": "^1.29.0",

dist/esm-4IzxhvVw.mjsView file

Lines 5490-5530javascript

5490//#endregion

5491//#region ../../node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5492/**

5493* Aliases are pseudos that are expressed as selectors.

5494*/

5495const aliases = {

5496 "any-link": ":is(a, area, link)[href]",

5497

dist/plugin-run-node-DwlY9TkG.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';

3import { dirname as __cjsShimDirname } from 'node:path';

4const __filename = __cjsShimFileURLToPath

dist/version-41j2IADg.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { fileURLToPath as __cjsShimFileURLToPath } from 'node:url';

3import { dirname as __cjsShimDirname } from 'node:path';

4const __filename = __cjsShimFileURLToPath

dist/run-shell-CPlOOTsM.mjsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/run-shell-CPlOOTsM.mjsView on unpkg · L4

icon.icoView file

•path = icon.ico kind = high_entropy_blob sizeBytes = 52489 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

icon.icoView on unpkg

dist/src-BWQTR-Q_.mjsView file

•path = dist/src-BWQTR-Q_.mjs kind = oversized_source_file sizeBytes = 4126719 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src-BWQTR-Q_.mjsView on unpkg

•path = dist/src-BWQTR-Q_.mjs kind = oversized_cli_entrypoint sizeBytes = 4126719 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/src-BWQTR-Q_.mjsView on unpkg