@navianpulse/designcheck@2.4.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@navianpulse/designcheck@2.4.1: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/designcheck.jsView file

12`+l.reasons.join(` L13: `):"")),d&&d.bundle&&d.bundle.trace&&d.bundle.trace[0]){const k=d.bundle.trace[0];console.log(" re-execute: designcheck "+o(k.url)+(Number.isFinite(k.width)?" --width="+Number... L14: Reply ONLY compact JSON: {"text_in_image": true|false, "decorative": true|false, "alt_ok": true|false, "better_alt": "improved alt or empty", "confidence": 0.0-1.0}.

High

Child Process

Package source references child process execution.

dist/bin/designcheck.jsView on unpkg · L12

1#!/usr/bin/env node L2: "use strict";const{readJson}=require("../lib/readjson");let chromium=null,pwDevices={};try{const e=require("playwright");chromium=e.chromium,pwDevices=e.devices||{}}catch{}const fs... L3: navian-designcheck: this trial ended`+(s?" on "+s:"")+" and has stopped working."+r+` ... L12: `+l.reasons.join(` L13: `):"")),d&&d.bundle&&d.bundle.trace&&d.bundle.trace[0]){const k=d.bundle.trace[0];console.log(" re-execute: designcheck "+o(k.url)+(Number.isFinite(k.width)?" --width="+Number... L14: Reply ONLY compact JSON: {"text_in_image": true|false, "decorative": true|false, "alt_ok": true|false, "better_alt": "improved alt or empty", "confidence": 0.0-1.0}.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/designcheck.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";const{readJson}=require("../lib/readjson");let chromium=null,pwDevices={};try{const e=require("playwright");chromium=e.chromium,pwDevices=e.devices||{}}catch{}const fs... L3: navian-designcheck: this trial ended`+(s?" on "+s:"")+" and has stopped working."+r+` ... L7: This build requires a valid per-customer license (NAVIAN_LICENSE_ENFORCE=1). L8: `),process.exit(2)),console.error(" \u26A0 UNLICENSED (advisory): "+o+". Running anyway \u2014 set NAVIAN_LICENSE_ENFORCE=1 to require one."),t}function printLicenseStatus(){const... L9: Next: npx playwright install chromium (one-time browser), then ask your agent to audit a page.`),process.exit(e.fail.length?1:0)}const installLicFlag=flags.find(e=>e.startsWith("... ... L12: `+l.reasons.join(` L13: `):"

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/bin/designcheck.jsView on unpkg · L1

dist/lib/setup.jsView file

1"use strict";const fs=require("fs"),os=require("os"),path=require("path"),RULES_SNIPPET=["## navian-designcheck \u2014 rendered-UI auditor","When the user asks to check, audit, tes... L2: `),MARKER="navian-designcheck \u2014 rendered-UI auditor";function pkgRoot(){return path.join(__dirname,"..")}function installClaudeSkill(n){const t=path.join(n||os.homedir(),".cla... L3: L4: `:"")+RULES_SNIPPET),"Codex AGENTS.md \u2192 "+t+(e?" (appended)":" (created)"))}function installLicense(n,t){if(!n)throw new Error("no license path given");let e;try{e=fs.readF... L5: `,{mode:384}),fs.renameSync(s,r);try{fs.chmodSync(r,384)}catch{}return r}function runSetup(n){n=n||{};const t=[],e=[];function i(o){try{t.push(o())}catch(r){e.push(String(r&&r.mess... L6: `,{mode:384}),fs.renameSync(r,o);try{fs

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/lib/setup.jsView on unpkg · L1

dist/lib/navian-core.wasmView file

•path = dist/lib/navian-core.wasm kind = wasm_module sizeBytes = 557648 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lib/navian-core.wasmView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 13-47json

13 "ui-testing",

14 "lighthouse-alternative",

15 "axe-alternative",

16 "zero-dependency"

17 ],

18 "bin": {

19 "designcheck": "dist/bin/designcheck.js"

20 },

21 "main": "dist/designcheck.js",

22 "files": [

23 "dist/"

24 ],

25 "scripts": {

26 "check": "node --check designcheck.js && node --check bin/designcheck.js && node --check lib/license.js && node --check lib/usage-meter.js && node --check lib/report.js && node --check lib/setup.js && node --check lib/pdfcheck.js && node --check lib/jurisdictions.js && node --check lib/impact.js && node --check lib/evidence.js && node --check lib/webview-cdp.js && node --check bin/postinstall.js",

27 "test": "node test/pdf-structtree.test.cjs && node test/pdf-scanned.test.cjs && node test/usage-meter.test.cjs && node test/evidence.test.cjs && node test/checks-registry.test.cjs && node test/probe-instrument.test.cjs && node test/report.test.cjs && node test/vision-verify.test.cjs && node test/telemetry.test.cjs && node test/context-packet.test.cjs && node test/mobile-webview.test.cjs && node test/webview-attach.test.cjs && node test/license.test.cjs",

28 "gen-checks": "node tools/gen-checks.cjs",

29 "build:dist": "node tools/build-dist.cjs",

30 "prepack": "node tools/build-dist.cjs",

31 "build:wasm": "cd mobile/core-rs-wasm && cargo build --target wasm32-unknown-unknown --release && cp target/wasm32-unknown-unknown/release/navian_audit_wasm.wasm ../../lib/navian-core.wasm",

32 "bench": "node test/bench/run.cjs",

33 "postinstall": "node dist/bin/postinstall.js || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "dependencies": {

36 "pdfjs-dist": "^3.11.174",

37 "playwright": "^1.48.0",

38 "pngjs": "^7.0.0"

39 },

40 "license": "SEE LICENSE IN LICENSE",

41 "comment": "The core engine (designcheck.js) has ZERO dependencies and runs in any browser. playwright is required ONLY by the optional CLI (bin/designcheck.js), which drives a headless browser so any coding agent can run the audit from a shell.",

42 "devDependencies": {

43 "esbuild": "^0.28.2",

44 "typescript": "^5.9.3"

45 }

46}

47

dist/bin/designcheck.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";const{readJson}=require("../lib/readjson");let chromium=null,pwDevices={};try{const e=require(

dist/lib/setup.jsView file

Lines 1-7javascript

1"use strict";const fs=require("fs"),os=require("os"),path=require("path"),RULES_SNIPPET=["## navian-designcheck \u2014 rendered-UI auditor",

dist/lib/navian-core.wasmView file

•path = dist/lib/navian-core.wasm kind = wasm_module sizeBytes = 557648 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lib/navian-core.wasmView on unpkg