Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 7 low-signal pattern(s) reviewed.

View on npm All versions

registry / @myrialabs/ptykit / 0.0.5

@myrialabs/ptykit@0.0.5

PTY sessions over WebSocket for Node & Bun — collaborative rooms, serialized-scrollback reattach, and a resilient browser client with one typed API.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chainNo supply-chain packaging signals triggered.

Manifest

WildcardDependency

scanned 29 file(s), 109 KB of source

Source & flagged code

1 flagged · loading source

dist/core/detect.jsView file

4* The PTY backend is an OPTIONAL dependency resolved at runtime via dynamic L5: * `import()`: `bun-pty` under Bun (tested), `node-pty` under Node (experimental). L6: * Importing lazily means a Node consumer never builds `bun-pty` (rust/ffi) and a

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/detect.jsView on unpkg · L4

Findings

4 Medium3 Low

MediumDynamic Requiredist/core/detect.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

65%Pass

Verdict confidence

Firewall policyNo policy match

Package metadata

npm

AuthorMyria Labs

Maintainersargafairuz, myrialabs-author

Version0.0.5

PublishedJul 3, 2026

LicenseMIT

Dependencies12

Integrityverified

Package size79.2 KB

Files116

Keywordsptypseudoterminalterminalwebsocketxtermbun-ptynode-ptyscrollback

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

Runtime

LPM CLI

node >=18

Artifact313 KB · 116 files1 signature(s) · provenance

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocketSupply chain: cleanWildcardDependency

@myrialabs/ptykit: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

1 flagged

dist/core/detect.jsView file

Lines 1-24javascript

1/**

2 * Runtime detection + lazy backend loading.

3 *

4 * The PTY backend is an OPTIONAL dependency resolved at runtime via dynamic

5 * `import()`: `bun-pty` under Bun (tested), `node-pty` under Node (experimental).

6 * Importing lazily means a Node consumer never builds `bun-pty` (rust/ffi) and a

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/detect.jsView on unpkg · L4

7 * Bun consumer never builds `node-pty`.

8 */

9/** True when running under Bun. */

10export function isBun() {

11 return (typeof globalThis.Bun !== 'undefined' ||

12 typeof process?.versions?.bun === 'string');

13}

14/** The backend that auto-detect will pick for the current runtime. */

15export function detectBackendName() {

16 return isBun() ? 'bun-pty' : 'node-pty';

17}

18/** Wrap a backend's raw PTY into the normalized handle. */

19function wrapPty(raw) {

20 return {

21 get pid() {

22 return raw.pid;

23 },

24 get cols() {