registry  /  @lmnr-ai/lmnr  /  0.8.37

@lmnr-ai/lmnr@0.8.37

TypeScript SDK for Laminar AI

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 14 file(s), 1.82 MB of source, external domains: 127.0.0.1, aiplatform.googleapis.com, api.anthropic.com, api.lmnr.ai, esbuild.github.io, evilmartians.com, www.laminar.sh, www.w3ctech.com

Source & flagged code

3 flagged · loading source
dist/index.cjsView file
22let _traceloop_instrumentation_vertexai = require("@traceloop/instrumentation-vertexai"); L23: let node_child_process = require("node:child_process"); L24: let node_crypto = require("node:crypto");
High
Child Process

Package source references child process execution.

dist/index.cjsView on unpkg · L22
22Cross-file remote execution chain: dist/index.cjs spawns dist/dist-muQLQb9o.cjs; helper contains network access plus dynamic code execution. L22: let _traceloop_instrumentation_vertexai = require("@traceloop/instrumentation-vertexai"); L23: let node_child_process = require("node:child_process"); L24: let node_crypto = require("node:crypto"); ... L28: fs = require_rolldown_runtime.__toESM(fs); L29: let net = require("net"); L30: net = require_rolldown_runtime.__toESM(net); ... L169: ...part, L170: data: part.data instanceof Uint8Array ? [redacted](part.data) : part.data L171: } : part) ... L495: */ L496: const readDebugSessionFile = (dir = process.cwd()) => { L497: try {
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L22
dist/cli.cjsView file
194const __dirname = require_dist.getDirname(); L195: new Function("require", "module", "__filename", "__dirname", moduleText)(require, module, __filename, __dirname); L196: return globalThis._evaluations;
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.cjsView on unpkg · L194

Findings

3 High2 Medium5 Low
HighChild Processdist/index.cjs
HighShell
HighCross File Remote Execution Contextdist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/cli.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings