@rosetears/aili-pi@0.1.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@rosetears/aili-pi@0.1.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

Lines 40-80json

40 "./extensions/zentui/index.ts"

41 ],

42 "skills": [

43 "./node_modules/pi-web-access/skills"

44 ],

45 "prompts": [

46 "./prompts/ideate.md",

47 "./prompts/define.md",

48 "./prompts/build.md",

49 "./prompts/ship.md",

50 "./prompts/local-review.md"

51 ],

52 "themes": [

53 "./themes/rem-cyberdeck.json"

54 ]

55 },

56 "engines": {

57 "node": ">=22.19.0"

58 },

59 "scripts": {

60 "postinstall": "node scripts/sync-global-skills.mjs --if-pi-managed",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "typecheck": "tsc --noEmit",

62 "test": "vitest run",

63 "sync:skills": "node --experimental-strip-types scripts/sync-skills.ts",

64 "verify:skills": "node --experimental-strip-types scripts/sync-skills.ts --verify",

65 "validate:skills": "npm run verify:skills",

66 "sync:roles": "node --experimental-strip-types scripts/sync-roles.ts",

67 "verify:roles": "node --experimental-strip-types scripts/sync-roles.ts --verify",

68 "validate:roles": "npm run verify:roles",

69 "sync:adapters": "node --experimental-strip-types scripts/apply-adapter-evidence.ts",

70 "validate:compatibility": "node --experimental-strip-types scripts/apply-adapter-evidence.ts --verify",

71 "generate:provenance": "node --experimental-strip-types scripts/generate-provenance.ts",

72 "validate:provenance": "node --experimental-strip-types scripts/generate-provenance.ts --verify",

73 "validate:capabilities": "node --experimental-strip-types scripts/validate-runtime.ts",

74 "validate:release": "node --experimental-strip-types scripts/validate-runtime.ts --release",

75 "test:doctor": "vitest run tests/unit/doctor.test.ts",

76 "test:bootstrap": "vitest run tests/bootstrap/bootstrap.test.ts",

77 "test:integration": "vitest run tests/integration",

78 "test:audit-redaction": "vitest run tests/unit/permissions.test.ts tests/unit/subagents.test.ts",

79 "test:e2e:linux-clean": "vitest run tests/bootstrap/bootstrap.test.ts && node --experimental-strip-types scripts/local-package-e2e.ts linux",

80 "validate:generated": "vitest run tests/unit/generated.test.ts",

extensions/zentui/runtime.tsView file

Lines 1-21typescript

1import { execFile } from "node:child_process";

2import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

extensions/zentui/runtime.tsView on unpkg · L1

3import { join } from "node:path";

4

skills/minimax-pdf/scripts/render_cover.jsView file

Lines 1-81javascript

1#!/usr/bin/env node

2/**

3 * render_cover.js — Render cover.html → cover.pdf via Playwright.

4 *

5 * Usage:

6 * node render_cover.js --input cover.html --out cover.pdf

7 * node render_cover.js --input cover.html --out cover.pdf --wait 1200

8 *

9 * Exit codes: 0 success, 1 bad args, 2 dependency missing, 3 render error

10 */

11

install.shView file

•path = install.sh kind = build_helper sizeBytes = 120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg