@myrialabs/clopen@0.4.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@myrialabs/clopen@0.4.11: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

backend/preview/browser/browser-console-manager.tsView file

215// Use Function constructor for safer evaluation than eval L216: const func = new Function('return ' + cmd); L217: return func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

backend/preview/browser/browser-console-manager.tsView on unpkg · L215

backend/subagents/service.tsView file

139L140: async import(raw: string, nameHint?: string): Promise<SubagentDTO> { L141: const parsed = parseDoc(raw);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

backend/subagents/service.tsView on unpkg · L139

bin/clopen.tsView file

7Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L7: console.error(''); L8: console.error('Install Bun: https://bun.sh'); L9: console.error('Then run: bun clopen'); ... L40: L41: // Get version from package.json L42: function getVersion(): string { L43: try { L44: const packagePath = join(__dirname, 'package.json'); L45: const packageJson = JSON.parse(readFileSync(packagePath, 'utf-8')); L46: return packageJson.version || '0.0.0'; ... L64: spinnerInterval = setInterval(() => { L65: process.stdout.write(`\r\x1b[K${frames[i]} ${spinnerMessage}`);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/clopen.tsView on unpkg · L7

dist/assets/zipkit-engine-CaR0t_Uy.wasmView file

•path = dist/assets/zipkit-engine-CaR0t_Uy.wasm kind = wasm_module sizeBytes = 1478118 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/zipkit-engine-CaR0t_Uy.wasmView on unpkg

dist/audio/tap.oggView file

•path = dist/audio/tap.ogg kind = high_entropy_blob sizeBytes = 25545 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/audio/tap.oggView on unpkg

dist/assets/main-CpHuyjKj.jsView file

•path = dist/assets/main-CpHuyjKj.js kind = oversized_source_file sizeBytes = 3505220 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-CpHuyjKj.jsView on unpkg

backend/engine/adapters/opencode/server.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @myrialabs/clopen@0.4.7 matchedIdentity = npm:QG15cmlhbGFicy9jbG9wZW4:0.4.7 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

backend/engine/adapters/opencode/server.tsView on unpkg

Source & flagged code

7 flagged

backend/preview/browser/browser-console-manager.tsView file

Lines 195-235typescript

195 }

196

197 toggleConsoleLogging(session: BrowserTab, enabled: boolean): boolean {

198 if (!session) return false;

199

200 session.consoleEnabled = enabled;

201

202 return true;

203 }

204

205 async executeConsoleCommand(session: BrowserTab, command: string): Promise<any> {

206 if (!session) throw new Error('Session not found');

207

208 try {

209

210

211 // Execute the command in the browser context

212 const result = await session.page.evaluate((cmd: string) => {

213 // Create a safe evaluation context

214 try {

215 // Use Function constructor for safer evaluation than eval

216 const func = new Function('return ' + cmd);

217 return func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

backend/preview/browser/browser-console-manager.tsView on unpkg · L215

218 } catch (error) {

219 return { error: error instanceof Error ? error.message : String(error) };

220 }

221 }, command);

222

223 // Log the command execution as a console message

224 const commandMessage: BrowserConsoleMessage = {

225 id: `command-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,

226 type: 'log',

227 text: `> ${command}`,

228 args: [result],

229 timestamp: Date.now()

230 };

231

232 session.consoleLogs.push(commandMessage);

233

234 // Emit the command result

235 this.emit('console-message', {

backend/subagents/service.tsView file

Lines 119-159typescript

119 id,

120 input.name.trim(),

121 input.description.trim(),

122 stringifyEngineMap(normalizeToolsMap(input.toolsByEngine)),

123 stringifyEngineMap(input.modelByEngine)

124 );

125 debug.log

bin/clopen.tsView file

Lines 1-27typescript

1#!/usr/bin/env bun

2

3// Runtime guard — Bun only, reject Node.js and Deno

4if (typeof globalThis.Bun === 'undefined') {

5 console.error('\x1b[31mError: Clopen requires Bun runtime.\x1b[0m');

6 console.error

dist/assets/zipkit-engine-CaR0t_Uy.wasmView file

•path = dist/assets/zipkit-engine-CaR0t_Uy.wasm kind = wasm_module sizeBytes = 1478118 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/zipkit-engine-CaR0t_Uy.wasmView on unpkg

dist/audio/tap.oggView file

•path = dist/audio/tap.ogg kind = high_entropy_blob sizeBytes = 25545 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/audio/tap.oggView on unpkg

dist/assets/main-CpHuyjKj.jsView file

•path = dist/assets/main-CpHuyjKj.js kind = oversized_source_file sizeBytes = 3505220 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/main-CpHuyjKj.jsView on unpkg

backend/engine/adapters/opencode/server.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @myrialabs/clopen@0.4.7 matchedIdentity = npm:QG15cmlhbGFicy9jbG9wZW4:0.4.7 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

backend/engine/adapters/opencode/server.tsView on unpkg