@meetless/mla@0.2.17: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@meetless/mla@0.2.17: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

dist/commands/ask.jsView file

Lines 81-121javascript

81 }

82 else if (!sawQuery) {

83 out.query = a;

84 sawQuery = true;

85 }

86 else {

87 throw new Error(`Unexpected positional argument: ${a} (quote the query as a single argument).`);

88 }

89 }

90 if (!out.query.trim()) {

91 throw new Error(`Usage: mla ask "<query>" [--mode answer|search|canonical|compare] [--workspace <id>] [--as-of <date>] [--max <n>] [--min <n>] [--plain]`);

92 }

93 return out;

94}

95// ask-core is plain ESM; `mla` compiles to CommonJS. A literal dynamic import()

96// would be downleveled by tsc to require(), which cannot load an ESM-only

97// package on Node < 22. The Function constructor preserves a TRUE runtime

98// import() so it works on every supported Node (>=18.18). Used only by the dev

99// fallback below (ts-node, no built dist). Resolve ask-core as a sibling package

100// directory (packages/ask-core), three levels up from the compiled commands dir

101// (dist/commands -> dist -> cli -> packages).

102const trueDynamicImport = new Function("u", "return import(u)");

103function askCoreDir() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/ask.jsView on unpkg · L101

104 return path.resolve(__dirname, "..", "..", "..", "ask-core");

105}

106// The CJS bundle the build emits (scripts/bundle-esm.js -> dist/bundles/). It

107// sits a sibling level up from the compiled commands dir: dist/commands -> dist

108// -> dist/bundles.

109function bundlePath(name) {

110 return path.resolve(__dirname, "..", "bundles", name);

111}

112function notesRoot() {

113 if (process.env.MEETLESS_NOTES_ROOT)

114 return process.env.MEETLESS_NOTES_ROOT;

115 // Best-effort: the standalone notes repo is a sibling of the code repo. A

116 // missing INDEX.md degrades to retrieval, so an imperfect guess here is

117 // non-fatal.

118 return path.resolve(__dirname, "..", "..", "..", "..", "..", "notes");

119}

120// Load ask-core from its ESM source files (the original path). Kept as the dev

121// fallback for `pnpm dev` (ts-node), where no dist/bundles exists. Never reached

dist/connectors/claude-code/plugin-detect.jsView file

Lines 38-78javascript

38exports.detectPluginOwnership = detectPluginOwnership;

39// plugin-detect.ts: decide whether THIS machine has our plugin installed, so the

40// migrator (plugin-migrate.ts) and `mla doctor` can reconcile legacy home-dir

41// wiring against it. Ownership is decided by an EXACT match on the fully-qualified

42// id `mla@meetless` (design §6.1), NOT a `startsWith("mla@")` prefix, which would

43// false-own someone else's fork published under a different marketplace. The result

44// is 4-state:

45//

46

dist/native/better_sqlite3.nodeView file

•path = dist/native/better_sqlite3.node kind = native_binary sizeBytes = 2072760 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/better_sqlite3.nodeView on unpkg

dist/hooks-template/user-prompt-submit.shView file

•path = dist/hooks-template/user-prompt-submit.sh kind = build_helper sizeBytes = 88006 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks-template/user-prompt-submit.shView on unpkg

dist/commands/activate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @meetless/mla@0.2.16 matchedIdentity = npm:QG1lZXRsZXNzL21sYQ:0.2.16 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/activate.jsView on unpkg