@pellux/goodvibes-tui: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@pellux/goodvibes-tui: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = sh scripts/check-bun.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = sh scripts/check-bun.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/runtime/onboarding/apply.tsView file

90patternName = generic_password severity = medium line = 90 matchedText = if (line...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/runtime/onboarding/apply.tsView on unpkg · L90

bin/launcher-support.jsView file

3import { createRequire } from 'node:module'; L4: import { spawnSync } from 'node:child_process'; L5: import { dirname, join } from 'node:path';

High

Child Process

Package source references child process execution.

bin/launcher-support.jsView on unpkg · L3

src/input/commands/hooks-runtime.tsView file

120} L121: await workbench.import(path, strategy); L122: ctx.print(`Imported managed hooks from ${path} using ${strategy} strategy.`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/input/commands/hooks-runtime.tsView on unpkg · L120

src/runtime/sandbox-public-gaps.tsView file

2import { dirname, resolve } from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import { ... L191: backend: 'local', L192: command: process.env.SHELL || 'bash', L193: args: ['-lc', `echo "goodvibes sandbox ${profile.id}: ${label}"`], ... L207: readonly status: number | null; L208: readonly stdout: string; L209: readonly stderr: string; ... L367: const authorizedKeys = publicKey L368: ? ` ssh_authorized_keys:\n - ${publicKey}\n` L369: : ' # Generate keys/goodvibes_qemu_ed25519.pub before rebuilding nocloud.iso.\n';

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/runtime/sandbox-public-gaps.tsView on unpkg · L2

2import { dirname, resolve } from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import { ... L191: backend: 'local', L192: command: process.env.SHELL || 'bash', L193: args: ['-lc', `echo "goodvibes sandbox ${profile.id}: ${label}"`], ... L207: readonly status: number | null; L208: readonly stdout: string; L209: readonly stderr: string; ... L367: const authorizedKeys = publicKey L368: ? ` ssh_authorized_keys:\n - ${publicKey}\n` L369: : ' # Generate keys/goodvibes_qemu_ed25519.pub before rebuilding nocloud.iso.\n';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/runtime/sandbox-public-gaps.tsView on unpkg · L2

src/verification/live-verifier.tsView file

89} L90: return `http://127.0.0.1:${port}`; L91: } ... L94: return new Promise((resolveCommand) => { L95: const child = spawn(command, args, { L96: cwd, L97: env: { ...process.env, NO_COLOR: '1' }, L98: stdio: ['ignore', 'pipe', 'pipe'],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/verification/live-verifier.tsView on unpkg · L89

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/input/commands/platform-sandbox-qemu.tsView file

•matchType = normalized_sha256 matchedPackage = @pellux/goodvibes-tui@0.29.0 matchedPath = src/input/commands/platform-sandbox-qemu.ts matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/input/commands/platform-sandbox-qemu.tsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 23-64json

23 "docs/foundation-artifacts"

24 ],

25 "scripts": {

26 "dev": "bun run src/main.ts",

27 "dev:watch": "bun --watch src/main.ts",

28 "prebuild": "bun run scripts/prebuild.ts",

29 "build": "bun build src/main.ts --compile --outfile dist/goodvibes",

30 "build:linux-x64": "goodvibes-build-binaries --target linux-x64",

31 "build:linux-arm64": "goodvibes-build-binaries --target linux-arm64",

32 "build:macos-x64": "goodvibes-build-binaries --target darwin-x64",

33 "build:macos-arm64": "goodvibes-build-binaries --target darwin-arm64",

34 "smoke:tui": "goodvibes-post-build-smoke",

35 "build:windows": "goodvibes-build-binaries --target windows-x64",

36 "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",

37 "typecheck": "bunx tsc --noEmit",

38 "typecheck:test": "bunx tsc --noEmit -p tsconfig.test.json",

39 "typecheck:coverage": "bun run scripts/typecheck-coverage-rule.ts",

40 "test": "bun run scripts/run-tests.ts",

41 "test:coverage": "bun run scripts/coverage-gate.ts",

42 "version": "bun run scripts/prebuild.ts",

43 "preinstall": "sh scripts/check-bun.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "postinstall": "bun scripts/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "postbuild": "bun scripts/postinstall.js --no-download",

46 "release": "bun run scripts/release.ts",

47 "release:dry": "bun run scripts/release.ts --dry-run",

48 "publish:package": "bun run scripts/publish-package.ts",

49 "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",

50 "platform:assemble": "bun run scripts/assemble-platform-packages.ts",

51 "platform:publish": "bun run scripts/publish-platform-packages.ts",

52 "platform:publish:dry-run": "bun run scripts/publish-platform-packages.ts --dry-run",

53 "publish:dry-run:github": "GOODVIBES_PUBLIC_PACKAGE_NAME=@mgd34msu/goodvibes-tui GOODVIBES_PUBLISH_REGISTRY=https://npm.pkg.github.com bun run scripts/publish-package.ts --dry-run",

54 "publish:check": "bun run scripts/publish-check.ts",

55 "verify:tag-version": "bun run scripts/verify-release-tag-version.ts",

56 "package:install-check": "bun run scripts/package-install-check.ts",

57 "build:prod": "goodvibes-build-binaries",

58 "build:all": "goodvibes-build-binaries --all",

59 "perf:check": "bun run scripts/perf-check.ts",

60 "perf:baseline": "GOODVIBES_PERF_SAVE_BASELINE=1 bun run scripts/perf-check.ts",

61 "architecture:check": "bun run scripts/check-architecture.ts",

62 "workflows:check": "bun run scripts/check-workflows.ts",

63 "audit:home": "bun run scripts/audit-goodvibes-home.ts",

64 "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",

src/runtime/onboarding/apply.tsView file

Lines 70-110typescript

70 readonly users?: Map<string, PersistedAuthUser>;

71 readonly sessions?: Map<string, { readonly token: string; readonly username: string; readonly expiresAt: number }>;

72}

73

74function restoreFile(path:

bin/launcher-support.jsView file

Lines 1-23javascript

1import { accessSync, chmodSync, constants, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { createHash } from 'node:crypto';

3import { createRequire } from 'node:module';

4import { spawnSync } from 'node:child_process'

src/input/commands/hooks-runtime.tsView file

Lines 100-140typescript

100 const path = args[1];

101 if (!path) {

102 ctx.print('Usage: /hooks inspect <path>');

103 return;

src/runtime/sandbox-public-gaps.tsView file

Lines 1-22typescript

1import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

2import { dirname, resolve } from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

Medium

Install Persistence

src/verification/live-verifier.tsView file

Lines 69-109typescript

69 }

70 } catch {

71 return undefined;

72 }

73 return undefined;

74}

75

76function

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/input/commands/platform-sandbox-qemu.tsView file

•matchType = normalized_sha256 matchedPackage = @pellux/goodvibes-tui@0.29.0 matchedPath = src/input/commands/platform-sandbox-qemu.ts matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/input/commands/platform-sandbox-qemu.tsView on unpkg