@lotics/cli@0.76.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@lotics/cli@0.76.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/app_commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lotics/cli@0.75.0 matchedIdentity = npm:QGxvdGljcy9jbGk:0.75.0 similarity = 0.821 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app_commands.jsView on unpkg

15import path from "node:path"; L16: import { spawn } from "node:child_process"; L17: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/app_commands.jsView on unpkg · L15

dist/src/cli.jsView file

47978execute() { L47979: for (const cmd of commands) cmd.execute(); L47980: },

High

Shell

Package source references shell execution.

dist/src/cli.jsView on unpkg · L47978

400modulo = (dividend - 1) % 26; L401: name = String.fromCharCode("A".charCodeAt(0) + modulo) + name; L402: dividend = Math.floor((dividend - modulo) / 26); ... L716: else if (v >= base1904) epoch += 24 * 60 * 60 * 1e3; L717: return (epoch - (dnthresh + (v.getTimezoneOffset() - basedate.getTimezoneOffset()) * 6e4)) / (24 * 60 * 60 * 1e3); L718: } ... L1910: } catch (e) { L1911: throw Error(`Error in https://github.com/jojoee/bahttext L1912: ${e.toString()}`); ... L10240: return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/cli.jsView on unpkg · L400

10240return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli.jsView on unpkg · L10240

dist/app_workflow_check.jsView file

86export async function loadProjectTypescript(projectDir) { L87: const requireFromProject = createRequire(path.join(projectDir, "package.json")); L88: let resolved;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app_workflow_check.jsView on unpkg · L86

dist/preview.jsView file

7// — inherent to rendering docx/xlsx, which are browser-rendered formats. L8: import { spawn } from "node:child_process"; L9: import { createServer } from "node:http"; L10: import { readFileSync, writeFileSync, existsSync, mkdtempSync, rmSync, readdirSync } from "node:fs"; ... L21: function findChrome() { L22: const env = process.env.LOTICS_CHROME || process.env.CHROME_PATH; L23: if (env && existsSync(env))

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/preview.jsView on unpkg · L7

dist/cli_dispatch.test.jsView file

15Cross-file remote execution chain: dist/cli_dispatch.test.js spawns dist/src/cli.js; helper contains network access plus dynamic code execution. L15: import { beforeAll, describe, expect, it } from "vitest"; L16: import { execFileSync, spawnSync } from "node:child_process"; L17: import fs from "node:fs"; ... L27: env: { L28: ...process.env, L29: LOTICS_API_KEY: "ltk_dispatch_smoke_fake_key_never_used_on_wire", ... L38: }); L39: return { status: result.status, stderr: result.stderr ?? "" }; L40: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli_dispatch.test.jsView on unpkg · L15

dist/dev/server.jsView file

4* Two child processes managed in one Node lifecycle: L5: * 1. Vite dev server (npx vite --port <vite-port>) — child_process.spawn, L6: * stdio inherited so Vite's own logging surfaces to the developer.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev/server.jsView on unpkg · L4

dist/render_page.jsView file

•path = dist/render_page.js kind = oversized_source_file sizeBytes = 2298288 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/render_page.jsView on unpkg

Source & flagged code

10 flagged

dist/app_commands.jsView file

Lines 1-35javascript

1/**

2 * `lotics app *` subcommands — create / pull / deploy.

3 *

4 * Apps are user-owned npm projects. Source-of-truth during editing is the

5 * local filesystem; the server stores deployed bundles (source.tar.gz + dist)

6 * in R2 keyed per version. These commands are the only sanctioned lifecycle

7 * surface — everything else (validate, logs, watch) folds into a flag on

8 * deploy or lives in the web UI.

9 *

10 * Tarball handling shells out to the system `tar` command. CLI users are

11 * developers; macOS/Linux/WSL all ship a working tar. Avoids adding a

12 * runtime dep to the published @lotics/cli package.

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { spawn } from "node:child_process";

17import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/app_commands.jsView on unpkg · L15

18import { buildStarterTemplate } from "./starter_template.js";

19import { startDevServer, openBrowser } from "./dev/server.js";

20import { ipv4ChildEnv } from "./child_env.js";

21import { generateAppWorkflowsDts } from "./generate_app_workflows_dts.js";

22import { generateAppAgentsDts } from "./generate_app_agents_dts.js";

23import { generateAppQueriesDts } from "./generate_app_queries_dts.js";

24import { collectQueryTableIds } from "@lotics/shared/app_query_ast";

25import { generateAppFields } from "./generate_app_fields.js";

26import { loadProjectTypescript, checkWorkflowBodies, } from "./app_workflow_check.js";

27/**

28 * Resolve the latest published version of a package from the npm registry.

29 * Returns null on any failure (network error, 404, malformed payload) so

30 * callers can fall back to a static pin rather than crashing `app create`.

31 *

32 * 1.5s timeout — npm registry is fast when reachable; the fallback is fine

33 * the rare times it isn't, and we don't want to block scaffold on a hang.

34 */

35export async function fetchLatestNpmVersion(packageName) {

•matchType = previous_version_dangerous_delta matchedPackage = @lotics/cli@0.75.0 matchedIdentity = npm:QGxvdGljcy9jbGk:0.75.0 similarity = 0.821 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app_commands.jsView on unpkg

dist/src/cli.jsView file

47978execute() { L47979: for (const cmd of commands) cmd.execute(); L47980: },

High

Shell

Package source references shell execution.

dist/src/cli.jsView on unpkg · L47978

400modulo = (dividend - 1) % 26; L401: name = String.fromCharCode("A".charCodeAt(0) + modulo) + name; L402: dividend = Math.floor((dividend - modulo) / 26); ... L716: else if (v >= base1904) epoch += 24 * 60 * 60 * 1e3; L717: return (epoch - (dnthresh + (v.getTimezoneOffset() - basedate.getTimezoneOffset()) * 6e4)) / (24 * 60 * 60 * 1e3); L718: } ... L1910: } catch (e) { L1911: throw Error(`Error in https://github.com/jojoee/bahttext L1912: ${e.toString()}`); ... L10240: return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/cli.jsView on unpkg · L400

10240return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli.jsView on unpkg · L10240

dist/app_workflow_check.jsView file

Lines 66-106javascript

66 *

67 * Mirrors the body shape `writeWorkflowFile` produces; recognized structurally

68 * (the `__workflow` opener) so a future header tweak can't silently desync the

69 * line mapping. A file with no recognizable opener (degraded) maps

dist/preview.jsView file

Lines 1-27javascript

1// `lotics preview <file.docx|.xlsx> [--out x.png]` — render a generated document to

2// a PNG using the SAME engines the frontend FilePreview uses. No npm deps: drives a

3// headless Chrome over CDP with Node built-ins (WebSocket/fetch/http/child_process),

4// keeping the CLI a single bundled binary. The render logic lives in the esbuild

5// browser bundle dist/render_page.js (built by build_cli.mjs); this file orchestrates

6// Chrome. Chrome itself is external (system Chrome / Playwright chromium / CHROME_PATH)

7// — inherent to rendering docx/xlsx, which are browser-rendered formats.

8import { spawn } from "node:child_process"

dist/cli_dispatch.test.jsView file

Lines 1-35javascript

1/**

2 * Dispatch smoke test over the BUILT CLI artifact — every `package` subcommand

3 * must route to its own handler, proven by its usage/refusal line appearing on

4 * a bare invocation. The dispatch in cli.ts is one hand-rolled argv walk with

5 * subcommand names repeated across command families (`doctor` exists in both

6 * `workspace` and `package`) and split positional conventions (`toolArgs` +

7 * `restArgs`), and nothing else tests it: `package yank` shipped dispatched

8 * inside the WORKSPACE family and surfaced only on the first live invocation.

9 *

10 * The fake API key satisfies `requireClient` (client construction is offline);

dist/dev/server.jsView file

Lines 1-24javascript

1/**

2 * `lotics app dev` orchestrator.

3 *

4 * Two child processes managed in one Node lifecycle:

5 * 1. Vite dev server (npx vite --port <vite-port>) — child_process.spawn,

6 * stdio inherited so Vite's own logging surfaces to the developer.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dev/server.jsView on unpkg · L4

7 * 2. node:http server on <port> serving:

8 * GET / → wrapper HTML (cached: no)

9

dist/render_page.jsView file

•path = dist/render_page.js kind = oversized_source_file sizeBytes = 2298288 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/render_page.jsView on unpkg