@mearl/native-host: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@mearl/native-host: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` ... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

763sys.exit(1) L764: `}});import{readFileSync as readFileSync7,statSync as statSync6}from"node:fs";import{dirname as dirname4,extname as extname2,resolve as resolve4}from"node:path";import{pathToFileUR... L765: `)}async function loadPlugin(entry,context,pluginName){let entryVersion;try{let stat2=statSync6(entry);if(!stat2.isFile())throw new Error("not a file");entryVersion=`${stat2.mtimeM... L766: `)},help(namespace,name2){let selected=name2?[find(name2)]:[...commands.values()],example=selected[0].command,input2=Object.fromEntries(example.registeredArguments.map(argument=>[a... L767: `)},async run(positionals,payload,namedInput={}){if(payload!==void 0&&positionals.length>0)throw new PluginError("PLUGIN_INVALID_INPUT","位置参数调用与 --payload 调用不能混用");if(payload!==voi... L768: "${nodePath}" "$

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L763

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... ... L18: (Did you mean one of ${similar.join(", ")}?)`:similar.length===1?` L19: (Did you mean

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1

Source & flagged code

14 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@mearl/native-host",

3 "version": "2.19.2",

4 "description": "Native Messaging Host for Mearl — bridges Chrome Extension and local socket server",

5 "type": "module",

6 "engines": {

7 "node": ">=22.12.0"

8 },

9 "main": "dist/install.js",

10 "types": "dist/install.d.ts",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

11 "exports": {

12 ".": {

13 "types": "./dist/install.d.ts",

14 "default": "./dist/install.js"

15 },

16 "./runtime": "./dist/index.js"

17 },

18 "bin": {

19 "mearl-native-host": "./dist/index.js"

20 },

21 "files": [

22 "dist/index.js",

Lines 36-58json

36 "uqr": "^0.1.2",

37 "ws": "^8.18.3"

38 },

39 "devDependencies": {

40 "@agentclientprotocol/sdk": "^1.2.1",

41 "@types/node": "^24.9.1",

42

dist/index.jsView file

763sys.exit(1) L764: `}});import{readFileSync as readFileSync7,statSync as statSync6}from"node:fs";import{dirname as dirname4,extname as extname2,resolve as resolve4}from"node:path";import{pathToFileUR... L765: `)}async function loadPlugin(entry,context,pluginName){let entryVersion;try{let stat2=statSync6(entry);if(!stat2.isFile())throw new Error("not a file");entryVersion=`${stat2.mtimeM... L766: `)},help(namespace,name2){let selected=name2?[find(name2)]:[...commands.values()],example=selected[0].command,input2=Object.fromEntries(example.registeredArguments.map(argument=>[a... L767: `)},async run(positionals,payload,namedInput={}){if(payload!==void 0&&positionals.length>0)throw new PluginError("PLUGIN_INVALID_INPUT","位置参数调用与 --payload 调用不能混用");if(payload!==voi... L768: "${nodePath}" "$

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L763

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... ... L18: (Did you mean one of ${similar.join(", ")}?)`:similar.length===1?` L19: (Did you mean

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1