@pellux/goodvibes-tui@1.20.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pellux/goodvibes-tui@1.20.0: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = sh scripts/check-bun.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = sh scripts/check-bun.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/runtime/onboarding/apply.tsView file

90patternName = generic_password severity = medium line = 90 matchedText = if (line...th);

Medium

Secret Pattern

Package contains a possible secret pattern.

src/runtime/onboarding/apply.tsView on unpkg · L90

bin/launcher-support.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pellux/goodvibes-tui@1.7.0 matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:1.7.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/launcher-support.jsView on unpkg

3import { createRequire } from 'node:module'; L4: import { spawnSync } from 'node:child_process'; L5: import { dirname, join } from 'node:path';

High

Child Process

Package source references child process execution.

bin/launcher-support.jsView on unpkg · L3

src/input/commands/hooks-runtime.tsView file

120} L121: await workbench.import(path, strategy); L122: ctx.print(`Imported managed hooks from ${path} using ${strategy} strategy.`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/input/commands/hooks-runtime.tsView on unpkg · L120

src/verification/live-verifier.tsView file

89} L90: return `http://127.0.0.1:${port}`; L91: } ... L94: return new Promise((resolveCommand) => { L95: const child = spawn(command, args, { L96: cwd, L97: env: { ...process.env, NO_COLOR: '1' }, L98: stdio: ['ignore', 'pipe', 'pipe'],

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/verification/live-verifier.tsView on unpkg · L89

src/runtime/sandbox-public-gaps.tsView file

2import { dirname, resolve } from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import { ... L191: backend: 'local', L192: command: process.env.SHELL || 'bash', L193: args: ['-lc', `echo "goodvibes sandbox ${profile.id}: ${label}"`], ... L207: readonly status: number | null; L208: readonly stdout: string; L209: readonly stderr: string; ... L367: const authorizedKeys = publicKey L368: ? ` ssh_authorized_keys:\n - ${publicKey}\n` L369: : ' # Generate keys/goodvibes_qemu_ed25519.pub before rebuilding nocloud.iso.\n';

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/runtime/sandbox-public-gaps.tsView on unpkg · L2

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/input/commands/platform-sandbox-qemu.tsView file

•matchType = normalized_sha256 matchedPackage = @pellux/goodvibes-tui@0.29.0 matchedPath = src/input/commands/platform-sandbox-qemu.ts matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/input/commands/platform-sandbox-qemu.tsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 27-68json

27 "dev": "bun run src/main.ts",

28 "daemon": "bun run src/daemon/cli.ts",

29 "dev:watch": "bun --watch src/main.ts",

30 "prebuild": "bun run scripts/prebuild.ts",

31 "build": "bun build src/main.ts --compile --outfile dist/goodvibes",

32 "build:linux-x64": "bun build src/main.ts --compile --target=bun-linux-x64 --outfile dist/goodvibes-linux-x64",

33 "build:linux-arm64": "bun build src/main.ts --compile --target=bun-linux-arm64 --outfile dist/goodvibes-linux-arm64",

34 "build:macos-x64": "bun build src/main.ts --compile --target=bun-darwin-x64 --outfile dist/goodvibes-macos-x64",

35 "build:macos-arm64": "bun build src/main.ts --compile --target=bun-darwin-arm64 --outfile dist/goodvibes-macos-arm64",

36 "build:daemon:linux-x64": "goodvibes-build-binaries --target daemon-linux-x64",

37 "build:daemon:linux-arm64": "goodvibes-build-binaries --target daemon-linux-arm64",

38 "build:daemon:macos-x64": "goodvibes-build-binaries --target daemon-macos-x64",

39 "build:daemon:macos-arm64": "goodvibes-build-binaries --target daemon-macos-arm64",

40 "smoke:daemon": "bun run scripts/post-build-smoke.ts",

41 "smoke:tui": "goodvibes-post-build-smoke",

42 "build:windows": "bun build src/main.ts --compile --target=bun-windows-x64 --outfile dist/goodvibes-windows.exe",

43 "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",

44 "test": "bun run scripts/run-tests.ts",

45 "test:coverage": "bun run scripts/coverage-gate.ts",

46 "version": "bun run scripts/prebuild.ts",

47 "preinstall": "sh scripts/check-bun.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "postinstall": "bun scripts/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 "postbuild": "bun scripts/postinstall.js --no-download",

50 "release": "bun run scripts/release.ts",

51 "release:dry": "bun run scripts/release.ts --dry-run",

52 "publish:package": "bun run scripts/publish-package.ts",

53 "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",

54 "platform:assemble": "bun run scripts/assemble-platform-packages.ts",

55 "platform:publish": "bun run scripts/publish-platform-packages.ts",

56 "platform:publish:dry-run": "bun run scripts/publish-platform-packages.ts --dry-run",

57 "publish:dry-run:github": "GOODVIBES_PUBLIC_PACKAGE_NAME=@mgd34msu/goodvibes-tui GOODVIBES_PUBLISH_REGISTRY=https://npm.pkg.github.com bun run scripts/publish-package.ts --dry-run",

58 "publish:check": "bun run scripts/publish-check.ts",

59 "package:install-check": "bun run scripts/package-install-check.ts",

60 "build:prod": "goodvibes-build-binaries",

61 "build:all": "goodvibes-build-binaries --all",

62 "perf:check": "bun run scripts/perf-check.ts",

63 "perf:baseline": "GOODVIBES_PERF_SAVE_BASELINE=1 bun run scripts/perf-check.ts",

64 "architecture:check": "bun run scripts/check-architecture.ts",

65 "workflows:check": "bun run scripts/check-workflows.ts",

66 "audit:home": "bun run scripts/audit-goodvibes-home.ts",

67 "foundation:artifacts": "bun run scripts/export-foundation-artifacts.ts",

68 "docs:commands": "bun run scripts/generate-command-reference.ts",

src/runtime/onboarding/apply.tsView file

Lines 70-110typescript

70 readonly users?: Map<string, PersistedAuthUser>;

71 readonly sessions?: Map<string, { readonly token: string; readonly username: string; readonly expiresAt: number }>;

72}

73

74function restoreFile(path:

bin/launcher-support.jsView file

Lines 1-23javascript

1import { accessSync, chmodSync, constants, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';

2import { createHash } from 'node:crypto';

3import { createRequire } from 'node:module';

4import { spawnSync } from 'node:child_process'

src/input/commands/hooks-runtime.tsView file

Lines 100-140typescript

100 const path = args[1];

101 if (!path) {

102 ctx.print('Usage: /hooks inspect <path>');

103 return;

src/verification/live-verifier.tsView file

Lines 69-109typescript

69 }

70 } catch {

71 return undefined;

72 }

73 return undefined;

74}

75

76function

src/runtime/sandbox-public-gaps.tsView file

Lines 1-22typescript

1import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';

2import { dirname, resolve } from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

Critical

Persistence Backdoor

scripts/check-bun.shView file

•path = scripts/check-bun.sh kind = build_helper sizeBytes = 461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-bun.shView on unpkg

src/input/commands/platform-sandbox-qemu.tsView file

•matchType = normalized_sha256 matchedPackage = @pellux/goodvibes-tui@0.29.0 matchedPath = src/input/commands/platform-sandbox-qemu.ts matchedIdentity = npm:QHBlbGx1eC9nb29kdmliZXMtdHVp:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/input/commands/platform-sandbox-qemu.tsView on unpkg