@metasession.co/devaudit-cli@0.3.14: Suspicious npm security

Loading npm security reports…

@metasession.co/devaudit-cli@0.3.14: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged

sdlc/src/bin/devaudit-sdlc.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const { spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg · L3

6const args = process.argv.slice(2);

7const sentinelPath = path.join(process.cwd(), '.sdlc-implementer-invoked');

8const watchStatePath = path.join(process.cwd(), '.sdlc-pr-watch.json');

9const DEFAULT_POLL_INTERVAL_SECONDS = 30;

10const DEFAULT_MAX_POLLS = 40;

11const DEFAULT_FLAKY_PATTERNS = [

12 'playwright',

13 'e2e',

14 'regression',

15 'smoke',

16 'flaky',

17 'retry',

18];

19const DEFAULT_INTEGRATION_BRANCH = 'develop';

20const DEFAULT_RELEASE_BRANCH = 'main';

21const REQUIRED_RELEASE_CHECKS = [

22 'Quality Gates',

23 'Release Scope Integrity',

•matchType = previous_version_dangerous_delta matchedPackage = @metasession.co/devaudit-cli@0.3.12 matchedIdentity = npm:[redacted]:0.3.12 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { Command, Option } from 'commander';

3import { createConsola } from 'consola';

4import { execa } from 'execa';

5import { join, resolve, basename, dirname, relative } from

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 27213 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

Source & flagged code

6 flagged · loading source

sdlc/src/bin/devaudit-sdlc.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg

3const path = require('path'); L4: const { spawnSync } = require('child_process'); L5:

High

Child Process

Package source references child process execution.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg · L3

dist/index.jsView file

3import { createConsola } from 'consola'; L4: import { execa } from 'execa'; L5: import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

1866} L1867: await execa("npx", ["husky", "init"], { cwd: ctx.projectPath, stdio: "inherit" }); L1868: return { step: "8/11 Bootstrap hook framework", status: "ok", message: ".husky/ bootstrapped" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1866

79const mainPath = resolve(dir, result.main); L80: const mod = await import(toFileUrl(mainPath)); L81: if (!mod.default || typeof mod.default !== "object") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L79

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 27213 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

@metasession.co/devaudit-cli@0.3.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code