@pmcai/codex-chat-widget@0.3.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@pmcai/codex-chat-widget@0.3.2: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

server/bin.jsView file

16Manifest entrypoint (scripts.start) carries capability families absent from dist/build output: environment+network, execution+network L16: const { startDaemon, stopDaemon, readState, readLog, probeHealth, runPaths } = await import('./lib/daemon.js') L17: const { spawn } = await import('node:child_process') L18: const { existsSync, readFileSync } = await import('node:fs') ... L55: Examples: L56: pmcai start --port 4231 --allowed-origin https://my-site.example L57: pmcai status ... L97: if (opts.version) { L98: console.log(JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8')).version) L99: process.exit(0) ... L104: L105: const pmaiHome = opts.flags.pmaiHome || process.env.PMAI_HOME || join(process.env.HOME || '.', '.pmai') L106: const port = Number(opts.flags.port || process.en

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L16

server/lib/gemini-models.jsView file

6} L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/lib/gemini-models.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> server/index.js -> server/lib/gemini-models.js L6: } L7: const baseUrl = (process.env.GOOGLE_AI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta').replace(/\/$/, '') L8: const upstream = await fetch(`${baseUrl}/models?key=${encodeURIComponent(apiKey)}`, { cache: 'no-store' }) L9: const body = await upstream.json().catch(() => ({})) L10: if (!upstream.ok) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server/lib/gemini-models.jsView on unpkg · L6

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

server/lib/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.3.1 matchedIdentity = npm:[redacted]:0.3.1 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/lib/daemon.jsView on unpkg

Source & flagged code

5 flagged

server/bin.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// Silence the node:sqlite ExperimentalWarning without a re-exec: patch process.emitWarning before

3// any dependency loads. (A child-process re-exec would need correct cross-platform path handling

4// and was the source of a Windows path bug — filtering the warning in-process is simpler and safe,

5// because a real sqlite failure still throws.)

6const originalEmitWarning = process.emitWarning

7process.emitWarning = (warning, ...rest) => {

8 const type = typeof rest[0] === 'string' ? rest[0] : (rest[0]?.type || '')

9 const text = typeof warning === 'string' ? warning : (warning?.message || '')

10 if (type === 'ExperimentalWarning' && /SQLite/i.test(text)) return

11 return originalEmitWarning.call(process, warning, ...rest)

12}

13

14const { createHarnessServer } = await import('./index.js')

15const { ensureCodex, CODEX_VERSION } = await import('./codex.js')

16const { startDaemon, stopDaemon, readState, readLog, probeHealth, runPaths } = await import('./lib/daemon.js')

17const { spawn } = await import('node:child_process')

18const { existsSync, readFileSync } = await import('node:fs')

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server/bin.jsView on unpkg · L16

19const { join, dirname } = await import('node:path')

20const { fileURLToPath } = await import('node:url')

21

22const here = dirname(fileURLToPath(import.meta.url))

23

24const HELP = `

25pmcai — Codex Harness (standalone server + widget)

26

27Usage:

28 pmcai <command> [options]

29

30Commands:

31 start Start the harness in the background

32 stop Stop the background harness (--force for SIGKILL)

33 restart Stop then start

34 status Show whether the harness is running

35 logs Print the daemon log (-f to follow, -n <lines>)

36 run Run in the foreground (Ctrl-C to stop)

server/lib/gemini-models.jsView file

Lines 1-21javascript

1export async function geminiModels(apiKey) {

2 if (!apiKey) {

3 const error = new Error(

dist/styles.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/styles.cssView on unpkg

server/lib/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pmcai/codex-chat-widget@0.3.1 matchedIdentity = npm:[redacted]:0.3.1 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/lib/daemon.jsView on unpkg