@lovrabet/lovrabet-cli@2.3.1: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@lovrabet/lovrabet-cli@2.3.1: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/commands/update.jsView file

1const a84_0x16cd80=a84_0x4225;(function(_0x45e821,_0x170f48){const _0x56be42=a84_0x4225,_0x5b7205=_0x45e821();while(!![]){try{const _0x502839=parseInt(_0x56be42(0x21e))/0x1*(-parse...

High

Child Process

Package source references child process execution.

lib/commands/update.jsView on unpkg · L1

1const a84_0x16cd80=a84_0x4225;(function(_0x45e821,_0x170f48){const _0x56be42=a84_0x4225,_0x5b7205=_0x45e821();while(!![]){try{const _0x502839=parseInt(_0x56be42(0x21e))/0x1*(-parse...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/commands/update.jsView on unpkg · L1

scripts/postinstall.mjsView file

17try { L18: const { runPostinstall } = await import(pathToFileURL(entry).href); L19: await runPostinstall();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L17

lib/generated/official-routing.jsView file

1function a125_0x2603(_0xbc89dc,_0x9b180b){_0xbc89dc=_0xbc89dc-0x6e;const _0x1f3730=a125_0x1f37();let _0x260351=_0x1f3730[_0xbc89dc];return _0x260351;}const a125_0x119b6b=a125_0x260...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/generated/official-routing.jsView on unpkg · L1

lib/commands/artifact/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/commands/artifact/index.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 46-86json

46 "build:dev": "rimraf lib && tsc && tsc-alias && node scripts/ensure-bin-executable.mjs",

47 "prestart": "node scripts/generate-build-info.js",

48 "start": "tsc --watch",

49 "pretypecheck": "node scripts/generate-build-info.js",

50 "typecheck": "tsc --noEmit",

51 "verify:bundled-jq": "node scripts/verify-bundled-jq.mjs",

52 "validate:cli-version-policy": "node scripts/validate-cli-version-policy.mjs",

53 "regression:release-smoke": "node scripts/regression-release-smoke.mjs",

54 "release:summary:prepare": "node scripts/release-summary-preparation.mjs",

55 "deploy:verify": "node scripts/deploy-verify.mjs",

56 "pack:dry-run-summary": "node scripts/package-dry-run-summary.mjs",

57 "verify:release-package": "node scripts/verify-release-package.mjs",

58 "publish:github": "node scripts/publish-github.mjs",

59 "lint": "echo 'No linter configured yet'",

60 "beta-release": "node scripts/beta-release.mjs",

61 "release": "node scripts/latest-release.mjs",

62 "check:lockfile": "node scripts/check-lockfile-integrity.mjs",

63 "check:skill-version": "node scripts/check-skill-version.mjs",

64 "generate:builtin-skill-manifest": "node scripts/generate-builtin-skill-manifest.mjs",

65 "check:builtin-skill-manifest": "node scripts/generate-builtin-skill-manifest.mjs --check",

66 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "ci": "npm run typecheck && npm run check:skill-version && npm run check:lockfile && npm run build",

68 "pretest": "node scripts/generate-build-info.js",

69 "test": "vitest run",

70 "pretest:run": "node scripts/generate-build-info.js",

71 "test:run": "vitest run",

72 "pretest:watch": "node scripts/generate-build-info.js",

73 "test:watch": "vitest",

74 "pretest:coverage": "node scripts/generate-build-info.js",

75 "test:coverage": "vitest run --coverage"

76 },

77 "files": [

78 "lib",

79 "skills/lovrabet",

80 "skills/lovrabet.manifest.json",

81 "scripts/postinstall.mjs",

82 "README.md",

83 "LICENSE",

84 "NOTICE"

85 ],

86 "dependencies": {

lib/commands/update.jsView file

Lines 1-1javascript

1const a84_0x16cd80=a84_0x4225;(function(_0x45e821,_0x170f48){const _0x56be42=a84_0x4225,_0x5b7205=_0x45e821();while(!![]){try{const _0x502839

scripts/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { existsSync } from "node:fs";

3import { dirname, join, resolve } from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

5

6const

lib/generated/official-routing.jsView file

Lines 1-1javascript

1function a125_0x2603(_0xbc89dc,_0x9b180b){_0xbc89dc=_0xbc89dc-0x6e;const _0x1f3730=a125_0x1f37();let _0x260351=_0x1f3730[_0xbc89dc];return _0x260351;}const a125_0x119b6b

lib/commands/artifact/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/commands/artifact/index.js#virtual:normalized:round1View on unpkg