@n1creator/openacp-cli@2026.718.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@n1creator/openacp-cli@2026.718.1: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/cli.jsView file

23822patternName = generic_password severity = medium line = 23822 matchedText = password...e.",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L23822

dist/index.jsView file

139function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L139

139Trigger-reachable chain: manifest.main -> dist/index.js L139: function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L139

1111}); L1112: import { execFileSync as execFileSync2 } from "child_process"; L1113: import * as fs10 from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1111

16809if (process.platform === "win32" && (ext === ".cmd" || ext === ".bat")) { L16810: return { command: process.env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${filePath}"`] }; L16811: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L16809

1631async function extractTarGz(buffer, destDir) { L1632: const { execFileSync: execFileSync9 } = await import("child_process"); L1633: const tmpFile = path10.join(destDir, "_archive.tar.gz");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1631

139function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L139

dist/speech/transcribe_audio.shView file

•path = dist/speech/transcribe_audio.sh kind = build_helper sizeBytes = 4338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/speech/transcribe_audio.shView on unpkg

Source & flagged code

8 flagged

dist/cli.jsView file

23822patternName = generic_password severity = medium line = 23822 matchedText = password...e.",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L23822

dist/index.jsView file

139function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L139

139Trigger-reachable chain: manifest.main -> dist/index.js L139: function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L139

1111}); L1112: import { execFileSync as execFileSync2 } from "child_process"; L1113: import * as fs10 from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1111

16809if (process.platform === "win32" && (ext === ".cmd" || ext === ".bat")) { L16810: return { command: process.env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${filePath}"`] }; L16811: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L16809

1631async function extractTarGz(buffer, destDir) { L1632: const { execFileSync: execFileSync9 } = await import("child_process"); L1633: const tmpFile = path10.join(destDir, "_archive.tar.gz");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1631

139function expandHome(p) { L140: return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p; L141: } ... L311: }); L312: if (typeof dest.end === "function") dest.end(); L313: else { ... L434: const registryPath = path2.join(os2.homedir(), ".openacp", "instances.json"); L435: const data = JSON.parse(fs2.readFileSync(registryPath, "utf-8")); L436: const instances = data?.instances ?? {}; ... L646: super(); L647: this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome2("~/.openacp/config.json"); L648: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L139

dist/speech/transcribe_audio.shView file

•path = dist/speech/transcribe_audio.sh kind = build_helper sizeBytes = 4338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/speech/transcribe_audio.shView on unpkg