@lutrin/core@1.1.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@lutrin/core@1.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

src/deck/browser.mjsView file

38import path from 'node:path'; L39: import { execFileSync } from 'node:child_process'; L40:

High

Child Process

Package source references child process execution.

src/deck/browser.mjsView on unpkg · L38

src/deck/assets.mjsView file

135package = @lutrin/core; repositoryIdentity = lutrin; dependency = @resvg/resvg-js L135: try { L136: _resvg = (await import('@resvg/resvg-js')).Resvg; L137: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/deck/assets.mjsView on unpkg · L135

34Cross-file remote execution chain: src/deck/assets.mjs spawns vendor/mermaid/mermaid.min.js; helper contains network access plus dynamic code execution. L34: * version. None of this is decorative caution: without these guards, a L35: * `![](http://169.254.169.254/…)` exfiltrates cloud credentials into a .pptx. L36: */ ... L41: import crypto from 'node:crypto'; L42: import dns from 'node:dns'; L43: import { execFileSync } from 'node:child_process'; L44: import { createRequire } from 'node:module'; ... L54: try { L55: return path.dirname(require.resolve(`${name}/package.json`)); L56: } catch { ... L88: // the declared range ("^1.24.0") reduced to its exact bound L89: const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/deck/assets.mjsView on unpkg · L34

34* version. None of this is decorative caution: without these guards, a L35: * `![](http://169.254.169.254/…)` exfiltrates cloud credentials into a .pptx. L36: */ ... L41: import crypto from 'node:crypto'; L42: import dns from 'node:dns'; L43: import { execFileSync } from 'node:child_process'; L44: import { createRequire } from 'node:module'; ... L54: try { L55: return path.dirname(require.resolve(`${name}/package.json`)); L56: } catch { ... L88: // the declared range ("^1.24.0") reduced to its exact bound L89: const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/deck/assets.mjsView on unpkg · L34

Source & flagged code

4 flagged

src/deck/browser.mjsView file

Lines 18-58javascript

18 *

19 * 1. `LUTRIN_BROWSER` — the escape hatch: an unusual install, a sandbox, a

20 * pinned build. Never second-guessed, and a wrong path is reported rather

21 * than silently skipped, otherwise setting the variable at all would be

22 * indistinguishable from not setting it;

23 * 2. `PUPPETEER_EXECUTABLE_PATH` — the same intent, spelled the way the

24 * surrounding ecosystem already spells it (containers, CI images);

25 * 3. `~/.cache/lutrin/browser/` — what `lutrin setup-mermaid` downloads when

26 * the machine really has no browser. Preferred over a system install

27 * because it is the one WE provisioned, at a version we know renders;

28 * 4. the system browsers, in the order below.

29 *

30 * Chrome, Edge, Brave and Chromium are all Chromium: any of them drives the

31 * CDP endpoint puppeteer-core speaks. Firefox and Safari are deliberately

32 * absent — Safari has no CDP at all, and Firefox's support does not cover what

33 * mermaid's rendering needs.

34 */

35

36import fs from 'node:fs';

37import os from 'node:os';

38import path from 'node:path';

39import { execFileSync } from 'node:child_process';

40

High

Child Process

Package source references child process execution.

src/deck/browser.mjsView on unpkg · L38

41/** Root of the user cache — same resolution as assets.mjs (LUTRIN_CACHE,

42 * MTL_DECK_CACHE for the tool's former name, XDG, then ~/.cache/lutrin).

43 * Duplicated rather than imported: assets.mjs imports THIS module, and the

44 * cycle would be paid on every load for six lines. */

45function userCacheRoot() {

46 return (

47 process.env.LUTRIN_CACHE ||

48 process.env.MTL_DECK_CACHE ||

49 (process.env.XDG_CACHE_HOME

50 ? path.join(process.env.XDG_CACHE_HOME, 'lutrin')

51 : path.join(os.homedir(), '.cache', 'lutrin'))

52 );

53}

54

55/** Where `lutrin setup-mermaid` puts the browser it downloads. */

56export const browserCacheDir = () => path.join(userCacheRoot(), 'browser');

57

58/** Candidate system paths, per platform, in order of preference. */

src/deck/assets.mjsView file

Lines 14-54javascript

14 * - `lucide:` icons → SVG resolved from node_modules/lucide-static,

15 * otherwise from the user cache `~/.cache/lutrin/icons/lucide/`,

16 * otherwise downloaded from unpkg at the PINNED version (lucideVersion)