@preventsenior/pvs-cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@preventsenior/pvs-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

14"release:perform": "npm publish", "postinstall": "node ./scripts/postinstall.js" }, "bin": { "p

Medium

Suspicious Lifecycle Evidence

The manifest runs a postinstall script during installation.

package.jsonView on unpkg · L14

src/commands/completion.jsView file

11Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js -> src/commands/completion.js L11: function detectShellEnvironment() { L12: const shell = process.env.SHELL || ''; L13: const isWindows = os.platform() === 'win32'; ... L16: L17: // Detectar se está rodando no CMD ou PowerShell do Windows L18: if (isWindows) { ... L52: function getShellConfigPaths() { L53: const homeDir = os.homedir(); L54: const isMac = os.platform() === 'darwin'; L55: L56: // No macOS Catalina+, zsh é o padrão, então .zshrc tem prioridade L57: if (isMac) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/commands/completion.jsView on unpkg · L11

11function detectShellEnvironment() { L12: const shell = process.env.SHELL || ''; L13: const isWindows = os.platform() === 'win32'; ... L16: L17: // Detectar se está rodando no CMD ou PowerShell do Windows L18: if (isWindows) { ... L52: function getShellConfigPaths() { L53: const homeDir = os.homedir(); L54: const isMac = os.platform() === 'darwin'; L55: L56: // No macOS Catalina+, zsh é o padrão, então .zshrc tem prioridade L57: if (isMac) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/commands/completion.jsView on unpkg · L11

scripts/postinstall.jsView file

1import chalk from "chalk"; import {gitAdicionarHooks} from "../src/utils/git/git-adicionar-hooks.js"; import {configurarGitAutomaticamente} from "../src/utils/git/git-config-automatico.js"; import {checkAndInstallCompletion} from "../src/commands/completion.js"; import {configurarClaudeAutomaticamente} from "../src/utils/util-claude-config.js"; import {autoInstallJq} from "../src/utils/jq/check-an

Medium

Suspicious Lifecycle Evidence

The postinstall script automatically calls Claude Code configuration and shell completion setup.

scripts/postinstall.jsView on unpkg · L1

Source & flagged code

6 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@preventsenior/pvs-cli",

3 "version": "3.7.1",

4 "description": "CLI from Prevent Senior Tech",

5 "main": "index.js",

6 "author": "Prevent Senior Tech",

7 "license": "MIT",

8 "type": "module",

9 "scripts": {

10 "release:prepare-patch": "npm version patch -m \"[lancamento de versao] [skip ci] Lancamento da versao patch %s \"",

11 "release:prepare-minor": "npm version minor -m \"[lancamento de versao] [skip ci] Lancamento da versao minor %s \"",

12 "release:prepare-major": "npm version major -m \"[lancamento de versao] [skip ci] Lancamento da versao major %s \"",

13 "release:push-master": "git push --tags && git push origin",

14 "release:perform": "npm publish",

15 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 },

17 "bin": {

18 "pvs": "./src/index.js"

Medium

Suspicious Lifecycle Evidence

The manifest runs a postinstall script during installation.

package.jsonView on unpkg · L14

19 },

20 "dependencies": {

21 "@clack/prompts": "0.7.0",

22 "axios": "1.8.2",

23 "chalk": "2.4.2",

24 "commander": "12.1.0",

25 "decompress": "4.2.1",

26 "figlet": "1.2.1",

27 "ini": "4.1.2",

28 "js-yaml": "4.1.0",

29 "node-fetch": "3.3.2",

30 "picocolors": "1.0.1",

31 "properties-reader": "2.3.0",

32 "shelljs": "0.8.5",

33 "tabtab": "3.0.2",

34 "xml2js": "0.6.2"

35 },

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/commands/completion.jsView file

Lines 1-31javascript

1import * as cp from '@clack/prompts';

2import color from "picocolors";

3import tabtab from 'tabtab';

4import os

scripts/postinstall.jsView file

Lines 1-17javascript

1import chalk from "chalk";

2import {gitAdicionarHooks} from "../src/utils/git/git-adicionar-hooks.js";

3import {configurarGitAutomaticamente} from "../src/utils/git/git-config-automatico.js";

4import {checkAndInstallCompletion} from "../src/commands/completion.js"