@mearl/native-host@2.16.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@mearl/native-host@2.16.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` ... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1

Source & flagged code

14 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@mearl/native-host",

3 "version": "2.16.4",

4 "description": "Native Messaging Host for Mearl — bridges Chrome Extension and local socket server",

5 "type": "module",

6 "engines": {

7 "node": ">=22.12.0"

8 },

9 "main": "dist/install.js",

10 "types": "dist/install.d.ts",

11 "exports": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

12 ".": {

13 "types": "./dist/install.d.ts",

14 "default": "./dist/install.js"

15 },

16 "./runtime": "./dist/index.js"

17 },

18 "bin": {

19 "mearl-native-host": "./dist/index.js"

20 },

21 "files": [

22 "dist/index.js",

Lines 34-56json

34 },

35 "dependencies": {

36 "ws": "^8.18.3"

37 },

38 "devDependencies": {

39 "@agentclientprotocol/sdk": "^1.2.1",

40 "@types/node": "^24.9.1",

41

dist/index.jsView file

38mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost();DEFAULT_EXTENSION_ID="aoehhjnofngknnje... L40: `))!==-1;)lines.push(this.buffer.slice(0,newlineIndex)),this.buffer=this.buffer.slice(newlineIndex+1);return{lines,overflow:!1}}};import http2 from"node:http";import WebSocket from... L41: `),encoded="";for(let n=0;n<str.length;n++){let c2=str.charCodeAt(n);c2<128?encoded+=String.fromCharCode(c2):c2<2048?(encoded+=String.fromCharCode(c2>>6|192),encoded+=String.fromCh...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L38

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `).join(` L5: `+prefix),args.push(colorCode+"m+"+module.exports.humanize(this.diff)+"\x1B[0m")}else args[0]=getDate()+name+" "+args[0]}function getDate(){return exports.inspectOpts.hideDate?"":n... L6: `)}function save(namespaces){namespaces?process.env.DEBUG=namespaces:delete process.env.DEBUG}function load(){return process.env.DEBUG}function init(debug){debug.inspectOpts={};let... L7: `).map(str=>str.trim()).join(" ")};formatters.O=function(v){return this.inspectOpts.colors

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

8"${nodePath}" "${hostPath}" %*\r L9: `;return fs17.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path17.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.stri... L10: `);return fs17.writeFileSync(launcherPath,content,"utf-8"),fs17.chmodSync(launcherPath,493),launcherPath}async function installNativeHost(options={}){let{mode="both",extensionId=DE... L11: Permission denied. Try running with sudo.`),!1}}async function uninstallNativeHost(options={},dependencies={}){return uninstallNativeHostArtifacts(options,dependencies)}async funct... ... L38: mearl get_requests --payload '{"count":1}' L39: `),success2?0:1}var DEFAULT_EXTENSION_ID,__filename,__dirname,ALL_MODES,init_install=__esm({"src/install.ts"(){"use strict";init_nativeHost(

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1