@optima-chat/dev-skills@0.14.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@optima-chat/dev-skills@0.14.0: Suspicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/helpers/query-db.tsView file

2L3: import { execSync } from 'child_process'; L4: import * as fs from 'fs'; ... L97: // 1. 优先从 PATH 中查找 L98: const whichCmd = process.platform === 'win32' ? 'where psql' : 'which psql'; L99: try { ... L133: : process.platform === 'win32' L134: ? 'Download from https://www.postgresql.org/download/windows/' L135: : 'sudo apt install postgresql-client'; ... L146: encoding: 'utf-8', L147: env: { ...process.env, PGPASSWORD: password } L148: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers/query-db.tsView on unpkg · L2

16patternName = generic_password severity = medium line = 16 matchedText = ci: { co...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/helpers/query-db.tsView on unpkg · L16

21patternName = generic_password severity = medium line = 21 matchedText = ci: { co...' },

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L21

26patternName = generic_password severity = medium line = 26 matchedText = ci: { co...' },

Medium

Secret Pattern

Hardcoded password in bin/helpers/query-db.ts

bin/helpers/query-db.tsView on unpkg · L26

scripts/install.jsView file

6Install-time AI-agent control hijack evidence: L6: L7: const CLAUDE_DIR = path.join(os.homedir(), '.claude'); L8: const SKILLS_SOURCE = path.join(__dirname, '..', '.claude'); L9: const CODEX_DIR = process.env.CODEX_HOME L10: ? path.resolve(process.env.CODEX_HOME) L11: : path.join(os.homedir(), '.codex'); L12: const CODEX_SOURCE = path.join(__dirname, '..', '.codex'); L13: const COMMANDS_DEST = path.join(CLAUDE_DIR, 'commands'); ... L36: if (!fs.existsSync(dest)) { L37: fs.mkdirSync(dest, { recursive: true }); L38: } ... L43: } else { Payload evidence from .claude/commands/logs.md: L304: L305: - CloudWatch Logs 文档: https://docs.aws.amazon.[redacted]/ L306: - AWS CLI logs 命令: https://docs.aws.amazon.com/cli/latest/reference/logs/

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install.jsView on unpkg · L6

dist/bin/helpers/query-db.jsView file

44patternName = generic_password severity = medium line = 44 matchedText = ci: { co...' },

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L44

49patternName = generic_password severity = medium line = 49 matchedText = ci: { co...' },

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L49

54patternName = generic_password severity = medium line = 54 matchedText = ci: { co...' },

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L54

Source & flagged code

10 flagged

package.jsonView file

Lines 4-44json

4 "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",

5 "main": "index.js",

6 "bin": {

7 "optima-dev-skills": "bin/cli.js",

8 "optima-account": "dist/bin/helpers/account.js",

9 "optima-entitlement": "dist/bin/helpers/entitlement.js",

10 "optima-generate-test-token": "dist/bin/helpers/generate-test-token.js",

11 "optima-grant-credits": "dist/bin/helpers/grant-credits.js",

12 "optima-grant-balance": "dist/bin/helpers/grant-credits.js",

13 "optima-grant-subscription": "dist/bin/helpers/grant-subscription.js",

14 "optima-logs": "dist/bin/helpers/logs.js",

15 "optima-plugin": "dist/bin/helpers/plugin.js",

16 "optima-discount": "dist/bin/helpers/discount.js",

17 "optima-product": "dist/bin/helpers/product.js",

18 "optima-query-db": "dist/bin/helpers/query-db.js",

19 "optima-show-env": "dist/bin/helpers/show-env.js",

20 "optima-verify-health": "dist/bin/helpers/verify-health.js",

21 "optima-cn-deploy": "dist/bin/helpers/cn-deploy.js"

22 },

23 "scripts": {

24 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "build": "tsc",

26 "prepare": "npm run build",

27 "pretest": "npm run build",

28 "test": "node --test tests/*.test.js"

29 },

30 "keywords": [

31 "claude-code",

32 "skills",

33 "optima",

34 "devops",

35 "logs",

36 "aws",

37 "cloudwatch"

38 ],

39 "author": "Optima AI Team",

40 "license": "MIT",

41 "repository": {

42 "type": "git",

43 "url": "git+https://github.com/Optima-Chat/optima-dev-skills.git"

44 },

bin/helpers/query-db.tsView file

Lines 1-46typescript

1#!/usr/bin/env node

2

3import { execSync } from 'child_process';

4import * as fs from 'fs';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers/query-db.tsView on unpkg · L2

scripts/install.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3const fs = require('fs');

4const path = require('path');

5const os

dist/bin/helpers/query-db.jsView file

Lines 24-64javascript

24 return ar;

25 };

26 return ownKeys(o);

27 };

28 return function (mod) {

29 if (mod &&