@minasoft/mina-ai-router: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@minasoft/mina-ai-router: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/packages/core/src/client-capability-service.jsView file

36exports.ClientCapabilityService = void 0; L37: const childProcess = __importStar(require("node:child_process")); L38: const mcp_preflight_1 = require("./mcp-preflight");

High

Child Process

Package source references child process execution.

dist/packages/core/src/client-capability-service.jsView on unpkg · L36

dist/apps/http-server/src/index.jsView file

3Object.defineProperty(exports, "__esModule", { value: true }); L4: const node_http_1 = require("node:http"); L5: const node_fs_1 = require("node:fs"); ... L7: const node_url_1 = require("node:url"); L8: const node_child_process_1 = require("node:child_process"); L9: const src_1 = require("../../../packages/core/src"); ... L15: const runtimeModuleUrl = (0, node_url_1.pathToFileURL)((0, node_path_1.join)(__dirname, "../../../../node_modules/@minasoft/mcp-runtime/dist/index.js")).href; L16: const port = Number(process.env.PORT ?? process.env.MINA_HTTP_PORT ?? 3333); L17: const host = process.env.HOST ?? process.env.MINA_HTTP_HOST ?? "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/apps/http-server/src/index.jsView on unpkg · L3

13const ask_ready_service_1 = require("./ask-ready-service"); L14: const importEsm = new Function("specifier", "return import(specifier)"); L15: const runtimeModuleUrl = (0, node_url_1.pathToFileURL)((0, node_path_1.join)(__dirname, "../../../../node_modules/@minasoft/mcp-runtime/dist/index.js")).href;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/apps/http-server/src/index.jsView on unpkg · L13

dist/packages/core/src/registry.jsView file

3exports.AgentRegistry = void 0; L4: const capability_profile_1 = require("./capability-profile"); L5: class AgentRegistry {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/core/src/registry.jsView on unpkg · L3

dist/apps/cli/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @minasoft/mina-ai-router@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/apps/cli/src/index.jsView on unpkg

Source & flagged code

5 flagged

dist/packages/core/src/client-capability-service.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.ClientCapabilityService = void 0;

37const childProcess = __importStar(require("node:child_process"));

38const mcp_preflight_1 = require("./mcp-preflight");

High

Child Process

Package source references child process execution.

dist/packages/core/src/client-capability-service.jsView on unpkg · L36

39class ClientCapabilityService {

40 constructor(endpoint) {

41 this.endpoint = endpoint;

42 }

43 mcpUrl() {

44 return `http://${this.endpoint.host}:${this.endpoint.port}/mcp`;

45 }

46 detectClient(agentType) {

47 const plan = (0, mcp_preflight_1.mcpClientCommandPlan)(agentType, "mina-ai-router", this.mcpUrl());

48 if (!plan) {

49 return {

50 client: agentType,

51 available: false,

52 detail: `Unsupported MCP setup client: ${agentType}`,

53 };

54 }

55 return {

56 client: plan.command,

dist/apps/http-server/src/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const node_http_1 = require("node:http");

5

dist/packages/core/src/registry.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.AgentRegistry = void 0;

4const capability_profile_1 =

dist/apps/cli/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @minasoft/mina-ai-router@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/apps/cli/src/index.jsView on unpkg