@rativiv/bob: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@rativiv/bob: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/shortcut-win.mjs && node scripts/rebuild-native.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/shortcut-win.mjs && node scripts/rebuild-native.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-electron/main/index.jsView file

8import w, { existsSync as $k } from "node:fs"; L9: import { spawn as Ue, execFile as tp, execSync as Ek } from "node:child_process"; L10: import qt from "node:os";

High

Child Process

Package source references child process execution.

dist-electron/main/index.jsView on unpkg · L8

14567const o = [t.command].concat(t.args).join(" "); L14568: t.args = ["/d", "/s", "/c", `"${o}"`], t.command = process.env.comspec || "cmd.exe", t.options.windowsVerbatimArguments = !0; L14569: }

High

Shell

Package source references shell execution.

dist-electron/main/index.jsView on unpkg · L14567

24160if ((t.type ?? (t.id === "openrouter" ? "api" : "cli")) === "api") { L24161: const n = t.loginUrl || "https://openrouter.ai/keys"; L24162: return await rr.openExternal(n), { started: !0, detail: `Opened ${t.id} key management page.` }; ... L24164: const r = t.loginCommand ?? t.cliCommand; L24165: return r ? process.platform === "win32" ? (await st(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", "start", "", "cmd", "/k", r], { L24166: windowsHide: !0

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-electron/main/index.jsView on unpkg · L24160

8import w, { existsSync as $k } from "node:fs"; L9: import { spawn as Ue, execFile as tp, execSync as Ek } from "node:child_process"; L10: import qt from "node:os"; ... L173: if (w.existsSync(e)) { L174: const r = w.readFileSync(e, "utf8"), n = JSON.parse(r); L175: if (typeof n.version == "string" && n.version.trim()) ... L1606: constructor(e) { L1607: S(this, "baseUrl"); L1608: S(this, "model"); ... L7137: * L7138: * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a "hint" to the model. For example, this information ... L7139: */

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist-electron/main/index.jsView on unpkg · L8

866try { L867: const { chromium: i } = await import("playwright"); L868: K("browser-session-starting", { workspaceRoot: e, executablePath: s ?? i.executablePath() });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-electron/main/index.jsView on unpkg · L866

11043u = `${i.scopeRefs(Nr.default.scope)}return ${d}`, this.opts.code.process && (u = this.opts.code.process(u, t)); L11044: const f = new Function(`${Nr.default.self}`, `${Nr.default.scope}`, u)(this, this.scope.get()); L11045: if (this.scope.value(c, { ref: f }), f.errors = null, f.schema = t.schema, f.schemaEnv = t, t.$async && (f.$async = !0), this.opts.code.source === !0 && (f.source = { validateName:...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-electron/main/index.jsView on unpkg · L11043

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 55220 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

dist/assets/index-DdVLZ7pV.jsView file

•path = dist/assets/index-DdVLZ7pV.js kind = oversized_source_file sizeBytes = 2860235 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/index-DdVLZ7pV.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 42-82json

42 "typecheck": "tsc --noEmit",

43 "check": "npm run typecheck && npm test",

44 "bump:version": "node scripts/bump-version.mjs",

45 "predev": "node -e \"const major = Number(process.versions.node.split('.')[0]); if (major < 20 || major >= 27) { console.error('\\nUnsupported Node.js version ' + process.version + '.\\nUse Node >=20 and <27 (recommended: Node 22 LTS).\\n'); process.exit(1); }\"",

46 "dev": "vite",

47 "dev:clean": "node scripts/dev-clean.mjs && npm run dev",

48 "prebuild:dist:raw": "node scripts/sync-icon.mjs",

49 "build:dist:raw": "tsc && vite build",

50 "build:dist": "node scripts/run-with-version-bump.mjs \"npm run build:dist:raw\"",

51 "browser:install": "node scripts/ensure-playwright-browser.mjs",

52 "build:portable:raw": "npm run browser:install && npm run build:dist:raw && npm run orch:build && electron-builder --win portable --publish never && node scripts/apply-exe-icon.mjs",

53 "build": "node scripts/build-dispatch.mjs",

54 "build:raw": "npm run build:portable:raw",

55 "build:portable": "node scripts/run-with-version-bump.mjs \"npm run build:portable:raw\"",

56 "package": "npm run build:portable",

57 "deploy": "npm run package",

58 "build:release": "npm run build:dist && electron-builder && node scripts/apply-exe-icon.mjs",

59 "build:release:raw": "npm run browser:install && npm run build:dist:raw && npm run orch:build && electron-builder --publish never && node scripts/apply-exe-icon.mjs",

60 "release:notes": "node scripts/create-release-notes.mjs",

61 "release:prepare": "node scripts/validate-version-files.mjs && node scripts/run-with-version-bump.mjs \"npm run release:notes && npm run build:portable:raw\"",

62 "postinstall": "node scripts/shortcut-win.mjs && node scripts/rebuild-native.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "publish:npm": "npm run build:dist:raw && npm pack --dry-run && npm publish",

64 "package:win": "npm run build:dist && npm run orch:build && electron-packager . Bob --platform=win32 --arch=x64 --out=release/0.0.1/packaged --overwrite --asar --prune=true --icon=build/icon.ico",

65 "preview": "vite preview",

66 "pretest": "vite build --mode=test",

67 "test": "vitest run",

68 "orch:build": "cd plugins/bob-orchestrator && npm run build:raw",

69 "orch:deploy": "npm run orch:build && node -e \"const fs=require('fs'),path=require('path'),os=require('os');const src=path.resolve('plugins/bob-orchestrator');const dest=path.join(os.homedir(),'.bob','plugins','bob-orchestrator');const distSrc=path.join(src,'dist');const distDest=path.join(dest,'dist');fs.rmSync(dest,{recursive:true,force:true});fs.mkdirSync(distDest,{recursive:true});for(const f of fs.readdirSync(distSrc))fs.cpSync(path.join(distSrc,f),path.join(distDest,f),{recursive:true});fs.cpSync(path.join(src,'package.json'),path.join(dest,'package.json'));console.log('Orchestrator ...

70 "build:all": "npm run build:portable && npm run orch:deploy"

71 },

72 "dependencies": {

73 "@codemirror/lang-cpp": "^6.0.3",

74 "@codemirror/lang-css": "^6.3.1",

75 "@codemirror/lang-html": "^6.4.11",

76 "@codemirror/lang-java": "^6.0.2",

77 "@codemirror/lang-javascript": "^6.2.4",

78 "@codemirror/lang-json": "^6.0.2",

79 "@codemirror/lang-markdown": "^6.5.0",

80 "@codemirror/lang-python": "^6.2.1",

81 "@codemirror/lang-rust": "^6.0.2",

82 "@codemirror/lang-sql": "^6.10.0",

Long lines were clipped for display.

dist-electron/main/index.jsView file

8import w, { existsSync as $k } from "node:fs"; L9: import { spawn as Ue, execFile as tp, execSync as Ek } from "node:child_process"; L10: import qt from "node:os";

High

Child Process

Package source references child process execution.

dist-electron/main/index.jsView on unpkg · L8

14567const o = [t.command].concat(t.args).join(" "); L14568: t.args = ["/d", "/s", "/c", `"${o}"`], t.command = process.env.comspec || "cmd.exe", t.options.windowsVerbatimArguments = !0; L14569: }

High

Shell

Package source references shell execution.

dist-electron/main/index.jsView on unpkg · L14567

24160if ((t.type ?? (t.id === "openrouter" ? "api" : "cli")) === "api") { L24161: const n = t.loginUrl || "https://openrouter.ai/keys"; L24162: return await rr.openExternal(n), { started: !0, detail: `Opened ${t.id} key management page.` }; ... L24164: const r = t.loginCommand ?? t.cliCommand; L24165: return r ? process.platform === "win32" ? (await st(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", "start", "", "cmd", "/k", r], { L24166: windowsHide: !0

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-electron/main/index.jsView on unpkg · L24160

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 55220 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

dist/assets/index-DdVLZ7pV.jsView file

•path = dist/assets/index-DdVLZ7pV.js kind = oversized_source_file sizeBytes = 2860235 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/index-DdVLZ7pV.jsView on unpkg