@markjaquith/agency@3.2.15: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@markjaquith/agency@3.2.15: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bun scripts/install-pi-extension.ts install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/install-pi-extension.ts install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/utils/interactive-loader.tsView file

3const preload = ["@opentui", "solid", "preload"].join("/") L4: await import(preload) L5: return import("./interactive")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/utils/interactive-loader.tsView on unpkg · L3

fixtures/protocol/error.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

fixtures/protocol/error.jsonView on unpkg

src/services/ReviewService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/services/ReviewService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/ReviewService.tsView on unpkg

pi-extensions/agency.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = pi-extensions/agency.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pi-extensions/agency.tsView on unpkg

src/services/TaskService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/services/TaskService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/TaskService.tsView on unpkg

src/services/VersionControlService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = [redacted].ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/VersionControlService.tsView on unpkg

src/utils/chooser.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/utils/chooser.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/chooser.tsView on unpkg

src/utils/process.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/utils/process.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/process.tsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 51-91json

51 "./schemas/agency-graph-v1.json": {

52 "default": "./schemas/agency-graph-v1.schema.json"

53 },

54 "./schemas/agency-execution-v1.json": {

55 "default": "./schemas/agency-execution-v1.schema.json"

56 },

57 "./fixtures/protocol/success.json": {

58 "default": "./fixtures/protocol/success.json"

59 },

60 "./fixtures/protocol/error.json": {

61 "default": "./fixtures/protocol/error.json"

62 }

63 },

64 "publishConfig": {

65 "access": "public",

66 "provenance": true,

67 "registry": "https://registry.npmjs.org/",

68 "tag": "latest"

69 },

70 "scripts": {

71 "postinstall": "bun scripts/install-pi-extension.ts install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "preuninstall": "bun scripts/install-pi-extension.ts uninstall",

73 "benchmark:act": "bun scripts/benchmark-act.ts",

74 "benchmark:pr": "bun scripts/benchmark-pr.ts",

75 "benchmark:repositories": "bun scripts/benchmark-repositories.ts",

76 "benchmark:status": "bun scripts/benchmark-status.ts",

77 "benchmark:next": "bun scripts/benchmark-next.ts",

78 "benchmark:init": "bun scripts/benchmark-init.ts",

79 "benchmark:integration": "bun scripts/benchmark-integration.ts",

80 "benchmark:workbase": "bun scripts/benchmark-workbase.ts",

81 "benchmark:doctor": "bun scripts/benchmark-doctor.ts",

82 "benchmark:context": "bun scripts/benchmark-context.ts",

83 "benchmark:epic": "bun scripts/benchmark-epic.ts",

84 "benchmark:phase": "bun scripts/benchmark-phase.ts",

85 "benchmark:graph": "bun scripts/benchmark-graph.ts",

86 "benchmark:push": "bun scripts/benchmark-push.ts",

87 "benchmark:archive": "bun scripts/benchmark-archive.ts",

88 "benchmark:sync": "bun scripts/benchmark-sync.ts",

89 "benchmark:task": "bun scripts/benchmark-task.ts",

90 "benchmark:validate": "bun scripts/benchmark-validate.ts",

91 "benchmark:worktree": "bun scripts/benchmark-worktree.ts",

src/utils/interactive-loader.tsView file

Lines 1-7typescript

1export const loadInteractive = async () => {

2 // Resolve this at runtime so the Node-target bundle still selects Bun's preload.

3 const preload = ["@opentui", "solid",

fixtures/protocol/error.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

fixtures/protocol/error.jsonView on unpkg

src/services/ReviewService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/services/ReviewService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/ReviewService.tsView on unpkg

pi-extensions/agency.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = pi-extensions/agency.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

pi-extensions/agency.tsView on unpkg

src/services/TaskService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/services/TaskService.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/TaskService.tsView on unpkg

src/services/VersionControlService.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = [redacted].ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/services/VersionControlService.tsView on unpkg

src/utils/chooser.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/utils/chooser.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/chooser.tsView on unpkg

src/utils/process.tsView file

•matchType = normalized_sha256 matchedPackage = @markjaquith/agency@3.2.14 matchedPath = src/utils/process.ts matchedIdentity = npm:QG1hcmtqYXF1aXRoL2FnZW5jeQ:3.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/process.tsView on unpkg