@pikku/cli@0.12.83: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@pikku/cli@0.12.83: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/src/functions/db/sqlite/sqlite-runtime-node.jsView file

54async function importNodeSqlite() { L55: const dynamicImport = new Function('return import("node:sqlite")'); L56: return dynamicImport();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/functions/db/sqlite/sqlite-runtime-node.jsView on unpkg · L54

dist/bin/pikku.jsView file

5return; L6: process.stderr.write(`${w.name}: ${w.message}\n`); L7: }); ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = dirname(__filename); L13: async function checkForUpdate() { L14: if (process.env.CI || !process.stderr.isTTY) L15: return; L16: try { L17: const { version: current } = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf-8')); L18: const res = await fetch('https://registry.npmjs.org/@pikku/cli/latest', { L19: signal: AbortSignal.timeout(3000),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/pikku.jsView on unpkg · L5

35try { L36: const { PikkuCLI } = await import(pathToFileURL(pikkuCliPath).href); L37: const updateCheck = checkForUpdate();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/pikku.jsView on unpkg · L35

dist/src/functions/db/local-db.jsView file

153finally { L154: await client.end(); L155: } ... L267: export async function reset(resolved, rootDir) { L268: if (process.env.NODE_ENV === 'production') { L269: throw new Error(`pikku db reset refused: NODE_ENV=production. This command only runs in dev.`); ... L313: * `ColumnEntry` is optional, so the empty-per-table scaffold is valid and means L314: * "everything default `private`". Returns whether a scaffold was written. L315: */

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/src/functions/db/local-db.jsView on unpkg · L153

console-app/assets/index-CN_U0k_D.jsView file

•path = console-app/assets/index-CN_U0k_D.js kind = oversized_source_file sizeBytes = 6623477 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

console-app/assets/index-CN_U0k_D.jsView on unpkg

skills/pikku-software-archaeology/scripts/validate.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pikku/cli@0.12.82 matchedIdentity = npm:QHBpa2t1L2NsaQ:0.12.82 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/pikku-software-archaeology/scripts/validate.mjsView on unpkg

Source & flagged code

6 flagged

dist/src/functions/db/sqlite/sqlite-runtime-node.jsView file

Lines 34-66javascript

34 changes: result.changes,

35 lastInsertRowid: result.lastInsertRowid,

36 };

37 }

38}

39class NodeSqliteDatabase {

40 db;

41 constructor(db) {

42 this.db = db;

43 }

44 exec(sql) {

45 this.db.exec(sql);

46 }

47 prepare(sql) {

48 return new NodeSqliteStatement(this.db.prepare(sql), sql);

49 }

50 close() {

51 this.db.close();

52 }

53}

54async function importNodeSqlite() {

55 const dynamicImport = new Function('return import("node:sqlite")');

56 return dynamicImport();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/functions/db/sqlite/sqlite-runtime-node.jsView on unpkg · L54

57}

58export async function createNodeSqliteRuntime() {

59 const { DatabaseSync } = await importNodeSqlite();

60 return {

61 open(filename) {

62 return new NodeSqliteDatabase(new DatabaseSync(filename));

63 },

64 };

65}

66

dist/bin/pikku.jsView file

Lines 1-51javascript

1#!/usr/bin/env node

2process.removeAllListeners('warning');

3process.on('warning', (w) => {

4 if (w.name === 'ExperimentalWarning' && w.message.includes

dist/src/functions/db/local-db.jsView file

Lines 133-173javascript

133 },

134 });

135}

136function pgliteAsClient(db) {

137 return {

138 query: (sql, params) => db.

console-app/assets/index-CN_U0k_D.jsView file

•path = console-app/assets/index-CN_U0k_D.js kind = oversized_source_file sizeBytes = 6623477 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

console-app/assets/index-CN_U0k_D.jsView on unpkg

skills/pikku-software-archaeology/scripts/validate.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pikku/cli@0.12.82 matchedIdentity = npm:QHBpa2t1L2NsaQ:0.12.82 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/pikku-software-archaeology/scripts/validate.mjsView on unpkg