@mevdragon/vidfarm-devcli@0.21.9: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@mevdragon/vidfarm-devcli@0.21.9: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = patch-package || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

public/assets/page-runtime-client-app.jsView file

16patternName = generic_password severity = medium line = 16 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Package contains a possible secret pattern.

public/assets/page-runtime-client-app.jsView on unpkg · L16

dist/src/cli.jsView file

2219package = @mevdragon/vidfarm-devcli; repositoryIdentity = vidfarm; dependency = ffmpeg-static L2219: try { L2220: const mod = (await import("ffmpeg-static")); L2221: const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L2219

•matchType = previous_version_dangerous_delta matchedPackage = @mevdragon/vidfarm-devcli@0.21.3 matchedIdentity = npm:[redacted]:0.21.3 similarity = 0.915 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

demo/dist/app.jsView file

•path = demo/dist/app.js kind = oversized_source_file sizeBytes = 3976471 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

demo/dist/app.jsView on unpkg

public/assets/homepage-client-app.jsView file

16patternName = generic_password severity = medium line = 16 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Hardcoded password in public/assets/homepage-client-app.js

public/assets/homepage-client-app.jsView on unpkg · L16

Source & flagged code

9 flagged

package.jsonView file

Lines 44-84json

44 "public/assets/**/*.svg",

45 "demo/dist/**",

46 ".agents/skills/**",

47 "README.md",

48 "SKILL.md",

49 "SKILL.director.md",

50 "!readme.secret.md",

51 "!**/*.secret.*"

52 ],

53 "publishConfig": {

54 "access": "public"

55 },

56 "repository": {

57 "type": "git",

58 "url": "git+https://github.com/OfficeXApp/vidfarm.git"

59 },

60 "engines": {

61 "node": ">=22.0.0"

62 },

63 "scripts": {

64 "postinstall": "patch-package || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 "dev": "tsx --import ./src/instrument.ts watch src/index.ts",

66 "dev:frontend": "node scripts/build-homepage-client.mjs --watch",

67 "dev:cli": "tsx src/cli.ts",

68 "build:frontend": "node scripts/build-homepage-client.mjs",

69 "build:hyperframes-editor": "cd demo && node scripts/build.mjs",

70 "build:serve-shells": "tsx scripts/build-serve-shells.ts",

71 "seo:refresh": "tsx scripts/generate-route-seo.ts",

72 "portfolio:share": "tsx scripts/render-portfolio-share.ts",

73 "operator:template-artifact": "node scripts/platform-operator-template-artifact.mjs",

74 "bootstrap:staging-templates": "tsx scripts/bootstrap-staging-template-releases.ts",

75 "migrate:sqlite-to-dynamodb": "tsx scripts/migrate-sqlite-to-dynamodb.ts",

76 "deploy:prod": "bash scripts/deploy-prod.sh",

77 "deploy:staging": "bash scripts/deploy-staging.sh",

78 "build": "npm run build:frontend && npm run build:hyperframes-editor && npm run build:serve-shells && node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",

79 "start": "node --import ./dist/src/instrument.js --enable-source-maps dist/src/index.js",

80 "check": "tsc -p tsconfig.json --noEmit && npm run check:skills",

81 "test:clips": "node --import tsx --test test/clip-curation.test.ts",

82 "check:skills": "node scripts/build-director-skill-rollup.mjs --check && node scripts/check-skill-routes.mjs",

83 "benchmark:editor-chat": "node --import tsx scripts/benchmark-editor-chat-harness.mjs",

84 "cdk:deploy:prod-serverless": "npm run build && dotenv -e .env.production -- npx aws-cdk deploy --app 'node dist/infra/cdk/bin/vidfarm-prod.js'",

public/assets/page-runtime-client-app.jsView file

16patternName = generic_password severity = medium line = 16 matchedText = `)}`)}fu...ent.

Medium

Secret Pattern

Package contains a possible secret pattern.

public/assets/page-runtime-client-app.jsView on unpkg · L16

dist/src/cli.jsView file

Lines 2199-2239javascript

2199 const rel = path.join("frames", `${slug}.png`);

2200 const target = path.join(input.dir, rel);

2201

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

demo/dist/app.jsView file

•path = demo/dist/app.js kind = oversized_source_file sizeBytes = 3976471 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

demo/dist/app.jsView on unpkg

public/assets/homepage-client-app.jsView file

Lines 1-36javascript

1var Mk=Object.create;var Uh=Object.defineProperty;var Lk=Object.getOwnPropertyDescriptor;var Ok=Object.getOwnPropertyNames;var Pk=Object.getPrototypeOf,Dk=Object.prototype.hasOwnProperty;var