@pmcai/codex-chat-widget@0.3.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pmcai/codex-chat-widget@0.3.0: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

server/bin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/bin.jsView on unpkg

8if (!process.env.PMCMAI_QUIET && !process.env.NODE_NO_WARNINGS) { L9: const { spawnSync } = await import('node:child_process') L10: const result = spawnSync(process.execPath, [new URL(import.meta.url).pathname, ...process.argv.slice(2)], {

High

Child Process

Package source references child process execution.

server/bin.jsView on unpkg · L8

7Manifest entrypoint (scripts.start) carries capability families absent from dist/build output: environment+network, execution+network L7: // `import './index.js'` would load node:sqlite (and print the warning) before the re-exec happens. L8: if (!process.env.PMCMAI_QUIET && !process.env.NODE_NO_WARNINGS) { L9: const { spawnSync } = await import('node:child_process') L10: const result = spawnSync(process.execPath, [new URL(import.meta.url).pathname, ...process.argv.slice(2)], { ... L58: Examples: L59: pmcai start --port 4231 --allowed-origin https://my-site.example L60: pmcai status ... L100: if (opts.version) { L101: console.log(JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8')).version) L102: process.exit(0) ... L133: if (health.ok) console.log(` ${dim('note: something is

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L7

daemon.test.mjsView file

60// --- the daemon actually serves the API and runs a turn --- L61: const base = `http://127.0.0.1:${port}` L62: const session = await (await fetch(`${base}/api/sessions`, { method: 'POST' })).json() ... L68: const cli = join(here, 'server', 'bin.js') L69: const restart = spawnSync(process.execPath, [cli, 'restart', '--pmai-home', home, '--port', String(port)], { encoding: 'utf8', env: process.env, timeout: 60000 }) L70: check('restart exit 0', restart.status === 0, restart.stderr?.slice(0, 120))

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

daemon.test.mjsView on unpkg · L60

60// --- the daemon actually serves the API and runs a turn --- L61: const base = `http://127.0.0.1:${port}` L62: const session = await (await fetch(`${base}/api/sessions`, { method: 'POST' })).json() L63: const chat = await fetch(`${base}/api/chat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ sessionId: session.id, prompt: 'daemon-turn' ... L64: const frames = (await chat.text()).split('\n\n').filter(Boolean).map((f) => JSON.parse(f.replace(/^data: /, ''))) ... L68: const cli = join(here, 'server', 'bin.js') L69: const restart = spawnSync(process.execPath, [cli, 'restart', '--pmai-home', home, '--port', String(port)], { encoding: 'utf8', env: process.env, timeout: 60000 }) L70: check('restart exit 0', restart.status === 0, restart.stderr?.s

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

daemon.test.mjsView on unpkg · L60

server/lib/gemini-models.jsView file

6} L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/lib/gemini-models.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> server/index.js -> server/lib/gemini-models.js L6: } L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server/lib/gemini-models.jsView on unpkg · L6

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

Source & flagged code

8 flagged

server/bin.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// NODE_NO_WARNINGS must be set before Node starts, so `pmcai` re-execs itself once with the flag

3// in the environment. That silences the node:sqlite ExperimentalWarning for a clean CLI without

4// hiding real errors (an actual sqlite failure still throws).

5//

6// Every dependency is imported dynamically AFTER this guard: ESM imports are hoisted, so a static

7// `import './index.js'` would load node:sqlite (and print the warning) before the re-exec happens.

8if (!process.env.PMCMAI_QUIET && !process.env.NODE_NO_WARNINGS) {

9 const { spawnSync } = await import('node:child_process')

10 const result = spawnSync(process.execPath, [new URL(import.meta.url).pathname, ...process.argv.slice(2)], {

High

Child Process

Package source references child process execution.

server/bin.jsView on unpkg · L8

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L7

11 stdio: 'inherit',

12 env: { ...process.env, NODE_NO_WARNINGS: '1', PMCMAI_QUIET: '1' },

13 })

14 process.exit(result.status ?? 1)

15}

16

17const { createHarnessServer } = await import('./index.js')

18const { ensureCodex, CODEX_VERSION } = await import('./codex.js')

19const { startDaemon, stopDaemon, readState, readLog, probeHealth, runPaths } = await import('./lib/daemon.js')

20const { spawn } = await import('node:child_process')

21const { existsSync, readFileSync } = await import('node:fs')

22const { join, dirname } = await import('node:path')

23const { fileURLToPath } = await import('node:url')

24

25const here = dirname(fileURLToPath(import.meta.url))

26

27const HELP = `

28pmcai — Codex Harness (standalone server + widget)

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/bin.jsView on unpkg

daemon.test.mjsView file

Lines 40-80javascript

40check('start reports started', started.started === true, started.error)

41check('start returns a pid', Number.isInteger(started.pid) && started.pid > 0, String(started.pid))

42check('health answered after start'

server/lib/gemini-models.jsView file

Lines 1-21javascript

1export async function geminiModels(apiKey) {

2 if (!apiKey) {

3 const error = new Error(

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg