@pixelzx/genesis@2026.7.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@pixelzx/genesis@2026.7.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src-7idbw9ZQ.jsView file

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src-7idbw9ZQ.jsView on unpkg · L1400

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/src-7idbw9ZQ.js

dist/src-7idbw9ZQ.jsView on unpkg · L1400

dist/test.DNmyFkvJ-Bq7SBuA8.jsView file

4924snapshotContents = content; L4925: new Function("exports", snapshotContents)(data); L4926: } catch {}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/test.DNmyFkvJ-Bq7SBuA8.jsView on unpkg · L4924

genesis.mjsView file

74try { L75: const mod = await import(specifier); L76: if (typeof mod.installProcessWarningFilter === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

genesis.mjsView on unpkg · L74

dist/dreaming-DYNA2eyC.jsView file

317const raw = await fs.readFile(statePath, "utf-8"); L318: return normalizeDailyIngestionState(JSON.parse(raw)); L319: } catch (err) { ... L335: const resolved = path.resolve(workspaceDir).replace(/\\/g, "/"); L336: return process.platform === "win32" ? resolved.toLowerCase() : resolved; L337: } ... L1566: return await [redacted]({ L1567: cleanedBody: event.cleanedBody, L1568: trigger: ctx.trigger,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/dreaming-DYNA2eyC.jsView on unpkg · L317

dist/update-cli-CXIfdAAT.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pixelzx/genesis@2026.7.9 matchedIdentity = npm:QHBpeGVsengvZ2VuZXNpcw:2026.7.9 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update-cli-CXIfdAAT.jsView on unpkg

37import path from "node:path"; L38: import { spawn, spawnSync } from "node:child_process"; L39: import os from "node:os"; ... L52: } L53: const GENESIS_REPO_URL = "https://github.com/PIXELZX0/Genesis.git"; L54: const MAX_LOG_CHARS = 8e3; ... L96: function resolveGitInstallDir() { L97: const override = process.env.GENESIS_GIT_DIR?.trim(); L98: if (override) return path.resolve(override); ... L101: function resolveDefaultGitDir() { L102: const home = os.homedir(); L103: if (home.startsWith("/")) return path.posix.join(home, "genesis");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-CXIfdAAT.jsView on unpkg · L37

dist/control-ui/assets/index-DKhy7yH_.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) `?(se++,ce=0):e?ce+=e.length:ce++,e&&(oe+=e.length),e}var ve={default:function(){switch(B){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DKhy7yH_.jsView on unpkg · L3

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/control-ui/favicon.icoView file

•path = dist/control-ui/favicon.ico kind = high_entropy_blob sizeBytes = 6436 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/control-ui/favicon.icoView on unpkg

dist/extensions/diagnostics-otel/index.jsView file

•path = dist/extensions/diagnostics-otel/index.js kind = oversized_source_file sizeBytes = 2267180 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diagnostics-otel/index.jsView on unpkg

dist/dist-DiycYvsS.jsView file

5170patternName = generic_password severity = medium line = 5170 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L5170

12559patternName = generic_password severity = medium line = 12559 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L12559

Source & flagged code

14 flagged

package.jsonView file

Lines 1413-1453json

1413 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1414 "lint:tmp:dynamic-import-warts": "node scripts/check-dynamic-import-warts.mjs",

1415 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1416 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1417 "lint:tmp:tsgo-core-boundary": "node scripts/check-tsgo-core-boundary.mjs",

1418 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1419 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1420 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1421 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1422 "mac:open": "open dist/Genesis.app",

1423 "mac:package": "bash scripts/package-mac-app.sh",

1424 "mac:restart": "bash scripts/restart-mac.sh",

1425 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1426 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1427 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1428 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1429 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1430 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1431 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1432 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

1433 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1433

1434 "prepack": "node --import tsx scripts/genesis-prepack.ts",

1435 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1436 "prepush:ci": "bash scripts/prepush-ci.sh",

1437 "probe:anthropic:prompt": "node --import tsx scripts/anthropic-prompt-probe.ts",

1438 "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && git diff --exit-code -- dist/protocol.schema.json apps/macos/Sources/GenesisProtocol/GatewayModels.swift apps/shared/GenesisKit/Sources/GenesisProtocol/GatewayModels.swift",

1439 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1440 "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",

1441 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1442 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1443 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1444 "proxy:run": "node scripts/run-node.mjs proxy run",

1445 "proxy:start": "node scripts/run-node.mjs proxy start",

1446 "qa:e2e": "node --import tsx scripts/qa-e2e.ts",

1447 "qa:lab:build": "vite build --config extensions/qa-lab/web/vite.config.ts",

1448 "qa:lab:ui": "pnpm genesis qa ui",

1449 "qa:lab:up": "node --import tsx scripts/qa-lab-up.ts",

1450 "qa:lab:up:fast": "node --import tsx scripts/qa-lab-up.ts --use-prebuilt-image --bind-ui-dist --skip-ui-build",

1451 "qa:lab:watch": "vite build --watch --config extensions/qa-lab/web/vite.config.ts",

1452 "release-metadata:check": "node scripts/check-release-metadata-only.mjs",

1453 "release:check": "pnpm deps:root-ownership:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

dist/src-7idbw9ZQ.jsView file

Lines 1380-1420javascript

1380//#region node_modules/jwks-rsa/node_modules/jose/dist/node/cjs/key/import.js

1381var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

1382 Object.defineProperty(exports, "__esModule", { value: true });

1383

dist/test.DNmyFkvJ-Bq7SBuA8.jsView file

Lines 4904-4944javascript

4904];

4905function addSerializer(plugin) {

4906 PLUGINS = [plugin].concat(PLUGINS);

4907}

4908function getSerializers() {

genesis.mjsView file

Lines 54-94javascript

54 if (!isModuleNotFoundError(err)) {

55 return false;

56 }

57

58 const expectedUrl = new URL(specifier,

dist/dreaming-DYNA2eyC.jsView file

Lines 297-337javascript

297 const files = {};

298 for (const [key, value] of Object.entries(filesRaw)) {

299 const file =

dist/update-cli-CXIfdAAT.jsView file

Lines 17-57javascript

17import { a as shellEscapeRestartLogValue, i as resolveGatewayRestartLogPath, n as renderPosixRestartLogSetup, s as quoteCmdScriptArg, t as renderCmdRestartLogSetup } from "./restart-logs-B0OTqRo0.js";

18import { r as resolveGatewayService } from "./service-DiHWY6iI.js";

dist/control-ui/assets/index-DKhy7yH_.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) `?(se++,ce=0):e?ce+=e.length:ce++,e&&(oe+=e.length),e}var ve={default:function(){switch(B){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DKhy7yH_.jsView on unpkg · L3

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/control-ui/favicon.icoView file

•path = dist/control-ui/favicon.ico kind = high_entropy_blob sizeBytes = 6436 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/control-ui/favicon.icoView on unpkg

dist/extensions/diagnostics-otel/index.jsView file

•path = dist/extensions/diagnostics-otel/index.js kind = oversized_source_file sizeBytes = 2267180 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diagnostics-otel/index.jsView on unpkg

dist/dist-DiycYvsS.jsView file

5170patternName = generic_password severity = medium line = 5170 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L5170

12559patternName = generic_password severity = medium line = 12559 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L12559