@platinum-dev/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

3 flagged

Lines 439-487javascript

439 let i = 0, label = text2;

440 const iv = setInterval(() => process.stderr.write(`\r${paint.cyan(frames[i = (i + 1) % frames.length])} ${label} `), 80);

441 return {

442 update(s) {

443 label = s;

444 },

445 stop(final) {

446 clearInterval(iv);

447 process.stderr.write("\r\x1B[K" + (final ? final + "\n" : ""));

448 }

449 };

450}

451async function ask(question) {

452 const rl = createInterface({ input: process.stdin, output: process.stderr });

453 try {

454 return (await new Promise((res) => rl.question(question, res))).trim();

455 } finally {

456 rl.close();

457 }

458}

459function note(ctx, msg) {

460 if (!ctx.quiet) process.stderr.write(msg + "\n");

461}

462

463// src/commands/init.ts

464import { defineCommand as defineCommand2 } from "citty";

465

466// src/commands/login.ts

467import { defineCommand } from "citty";

468import { spawn } from "child_process";

469import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/pt.jsView on unpkg · L467

470import { randomBytes } from "crypto";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/pt.jsView on unpkg · L459

471import { hostname } from "os";

472function openBrowser(url2) {

473 const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : [

474 try {

475 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

476 } catch {

477 }

478}

479function loopbackLogin(ctx, dash) {

480 const state = randomBytes(16).toString("hex");

481 return new Promise((resolve, reject) => {

482 let settled = false;

483 const done = (fn) => {

484 if (!settled) {

485 settled = true;

486 fn();

487 server.close();

Lines 6459-6499javascript

6459 stdout: out.text,

6460 stderr: err.text,

6461 stdout_truncated: out.truncated,

6462 stderr_truncated: err.truncated,

6463 notes

6464 }

6465 };

6466 }

6467 const execOutputShape

Source & flagged code

3 flagged · loading source

dist/pt.jsView file

467import { defineCommand } from "citty"; L468: import { spawn } from "child_process"; L469: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/pt.jsView on unpkg · L467

6479title: "Run shell command", L6480: description: "Run a shell command in a Platinum sandbox microVM (executed via sh -c). sandbox_id is OPTIONAL: when omitted, a small ephemeral default sandbox is reused or auto-crea... L6481: inputSchema: {

High

Shell

Package source references shell execution.

dist/pt.jsView on unpkg · L6479

459function note(ctx, msg) { L460: if (!ctx.quiet) process.stderr.write(msg + "\n"); L461: } ... L467: import { defineCommand } from "citty"; L468: import { spawn } from "child_process"; L469: import { createServer } from "http"; L470: import { randomBytes } from "crypto";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/pt.jsView on unpkg · L459

@platinum-dev/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/pt.jsView file

Lines 439-487javascript

439 let i = 0, label = text2;

440 const iv = setInterval(() => process.stderr.write(`\r${paint.cyan(frames[i = (i + 1) % frames.length])} ${label} `), 80);

441 return {

442 update(s) {

443 label = s;

444 },

445 stop(final) {

446 clearInterval(iv);

447 process.stderr.write("\r\x1B[K" + (final ? final + "\n" : ""));

448 }

449 };

450}

451async function ask(question) {

452 const rl = createInterface({ input: process.stdin, output: process.stderr });

453 try {

454 return (await new Promise((res) => rl.question(question, res))).trim();

455 } finally {

456 rl.close();

457 }

458}

459function note(ctx, msg) {

460 if (!ctx.quiet) process.stderr.write(msg + "\n");

461}

462

463// src/commands/init.ts

464import { defineCommand as defineCommand2 } from "citty";

465

466// src/commands/login.ts

467import { defineCommand } from "citty";

468import { spawn } from "child_process";

469import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/pt.jsView on unpkg · L467

470import { randomBytes } from "crypto";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/pt.jsView on unpkg · L459

471import { hostname } from "os";

472function openBrowser(url2) {

473 const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : [

474 try {

475 spawn(cmd, args, { stdio: "ignore", detached: true }).unref();

476 } catch {

477 }

478}

479function loopbackLogin(ctx, dash) {

480 const state = randomBytes(16).toString("hex");

481 return new Promise((resolve, reject) => {

482 let settled = false;

483 const done = (fn) => {

484 if (!settled) {

485 settled = true;

486 fn();

487 server.close();

Lines 6459-6499javascript

6459 stdout: out.text,

6460 stderr: err.text,

6461 stdout_truncated: out.truncated,

6462 stderr_truncated: err.truncated,

6463 notes

6464 }

6465 };

6466 }

6467 const execOutputShape

@platinum-dev/cli@0.3.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code