@mearl/native-host@2.18.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@mearl/native-host@2.18.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/index.js --init || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node dist/index.js --init || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `)}displayWidth(str){return stripVTControlCharacters(str).length}styleTitle(str){return str}styleUsage(str){return str.split(" ").map(word=>word==="[options]"?this.styleOptionText(... L5: `+" ".repeat(termWidth+spacerWidth)),itemIndentStr+paddedTerm+" ".repeat(spacerWidth)

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node dist/index.js --init || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

424sys.exit(1) L425: `}});import{readFileSync as readFileSync6,statSync as statSync6}from"node:fs";import{dirname as dirname4,extname as extname2,resolve as resolve4}from"node:path";import{pathToFileUR... L426: `)}async function loadPlugin(entry,context,pluginName){let entryVersion;try{let stat2=statSync6(entry);if(!stat2.isFile())throw new Error("not a file");entryVersion=`${stat2.mtimeM... L427: `)},help(namespace,name2){let selected=name2?[find(name2)]:[...commands.values()],example=selected[0].command,input=Object.fromEntries(example.registeredArguments.map(argument=>[ar... L428: `)},async run(positionals,payload,namedInput={}){if(payload!==void 0&&positionals.length>0)throw new PluginError("PLUGIN_INVALID_INPUT","位置参数调用与 --payload 调用不能混用");if(payload!==voi... L429: `).join(` ... L4

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L424

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `)}displayWidth(str){return stripVTControlCharacters(str).length}styleTitle(str){return str}styleUsage(str){return str.split(" ").map(word=>word==="[options]"?this.styleOptionText(... ... L14: (Did you mean one of ${similar.join(", ")}?)`:similar.length===1?` L15: (Did you mean ${similar[0]}?)`:""}var init_suggestSimilar=__esm({"../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/suggestSimilar.js"(){}});import{EventEmitter}... L16: - specify the name in Comm

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1

Source & flagged code

14 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@mearl/native-host",

3 "version": "2.18.0",

4 "description": "Native Messaging Host for Mearl — bridges Chrome Extension and local socket server",

5 "type": "module",

6 "engines": {

7 "node": ">=22.12.0"

8 },

9 "main": "dist/install.js",

10 "types": "dist/install.d.ts",

11 "exports": {

12 ".": {

13 "types": "./dist/install.d.ts",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

14 "default": "./dist/install.js"

15 },

16 "./runtime": "./dist/index.js"

17 },

18 "bin": {

19 "mearl-native-host": "./dist/index.js"

20 },

21 "files": [

22 "dist/index.js",

Lines 35-57json

35 "dependencies": {

36 "ws": "^8.18.3"

37 },

38 "devDependencies": {

39 "@agentclientprotocol/sdk": "^1.2.1",

40 "@types/node": "^24.9.1",

41 "@types/ws":

dist/index.jsView file

424sys.exit(1) L425: `}});import{readFileSync as readFileSync6,statSync as statSync6}from"node:fs";import{dirname as dirname4,extname as extname2,resolve as resolve4}from"node:path";import{pathToFileUR... L426: `)}async function loadPlugin(entry,context,pluginName){let entryVersion;try{let stat2=statSync6(entry);if(!stat2.isFile())throw new Error("not a file");entryVersion=`${stat2.mtimeM... L427: `)},help(namespace,name2){let selected=name2?[find(name2)]:[...commands.values()],example=selected[0].command,input=Object.fromEntries(example.registeredArguments.map(argument=>[ar... L428: `)},async run(positionals,payload,namedInput={}){if(payload!==void 0&&positionals.length>0)throw new PluginError("PLUGIN_INVALID_INPUT","位置参数调用与 --payload 调用不能混用");if(payload!==voi... L429: `).join(` ... L4

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L424

2import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L3: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L4: `)}displayWidth(str){return stripVTControlCharacters(str).length}styleTitle(str){return str}styleUsage(str){return str.split(" ").map(word=>word==="[options]"?this.styleOptionText(... ... L14: (Did you mean one of ${similar.join(", ")}?)`:similar.length===1?` L15: (Did you mean ${similar[0]}?)`:""}var init_suggestSimilar=__esm({"../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/suggestSimilar.js"(){}});import{EventEmitter}... L16: - specify the name in Comm

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L2

dist/install.jsView file

1Cross-file remote execution chain: dist/install.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __mearlCreateRequire } from 'node:module'; const require = __mearlCreateRequire(import.meta.url); L2: import fs2 from"node:fs";import path2 from"node:path";import{execFileSync as execFileSync2}from"node:child_process";import{createRequire}from"node:module";import{fileURLToPath}from... L3: "${nodePath}" "${hostPath}" %*\r L4: `;return fs2.writeFileSync(launcherPath2,content2,"utf-8"),launcherPath2}let launcherPath=path2.join(hostDir,`${hostName}-launcher.sh`),content=["#!/bin/sh",`NODE_BIN=${JSON.string... L5: `);return fs2.writeFileSync(launcherPath,content,"utf-8"),fs2.chmodSync(launcherPath,493),launcherPath}async function inst

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/install.jsView on unpkg · L1