@runfusion/fusion@0.70.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@runfusion/fusion@0.70.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/chunk-4L6CLWJC.jsView file

4235*/ L4236: exec(sql) { L4237: this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4235

4995} L4996: async function hasPowerShell3(dependencies) { L4997: const major = parseInt(dependencies.release.split(".")[0], 10);

High

Shell

Package source references shell execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4995

dist/chunk-AWKNRUOR.jsView file

6632. **Secrets and credentials** \u2014 Ensure no hardcoded passwords, API keys, tokens, or private keys L664: 3. **Unsafe eval** \u2014 Check for eval(), new Function(), or similar dangerous patterns L665: 4. **Path traversal** \u2014 Verify file path handling prevents directory traversal attacks

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-AWKNRUOR.jsView on unpkg · L663

bin.mjsView file

19L20: await import(pathToFileURL(distEntry).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.mjsView on unpkg · L19

dist/chunk-PSDYB45U.jsView file

28function shouldSkipBackgroundQmdRefresh() { L29: return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.FUSION_ENABLE_QMD_REFRESH_IN_TESTS !== "1"; L30: } ... L168: async write(rootDir, content) { L169: const result = await this.fileBackend.write(rootDir, content); L170: scheduleQmdProjectMemoryRefresh(rootDir); ... L453: try { L454: const { execFile } = await import("child_process"); L455: const { promisify } = await import("util"); ... L459: const args = buildQmdSearchArgs(rootDir, options); L460: const { stdout } = await execFileAsync(command, args, { L461: cwd: rootDir,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-PSDYB45U.jsView on unpkg · L28

dist/plugins/fusion-plugin-compound-engineering/skills/ce-brainstorm/scripts/visual-probe-server.jsView file

2/* global console, process, setInterval, setTimeout */ L3: import { execFileSync, spawn } from "node:child_process" L4: import fs from "node:fs" L5: import http from "node:http" L6: import path from "node:path" ... L11: const DEFAULT_URL_HOST = "localhost" L12: const IDLE_TIMEOUT_MS = Number(process.env.CE_VISUAL_PROBE_IDLE_TIMEOUT_MS) || 30 * 60 * 1000 L13: const LIFECYCLE_CHECK_MS = Number(process.env.CE_VISUAL_PROBE_LIFECYCLE_CHECK_MS) || 60 * 1000

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/plugins/fusion-plugin-compound-engineering/skills/ce-brainstorm/scripts/visual-probe-server.jsView on unpkg · L2

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView file

•path = dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.sh kind = build_helper sizeBytes = 12403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView on unpkg

dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.jsView file

•path = dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.js kind = payload_in_excluded_dir sizeBytes = 6726679 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.jsView on unpkg

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 16622429 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 16622429 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg

dist/client/assets/cytoscape.esm-OyMbaexL.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg

Source & flagged code

12 flagged

dist/chunk-4L6CLWJC.jsView file

Lines 4215-4255javascript

4215 return { ok: false, reason: "not_found", current: null };

4216 }

4217 if (existing.ownerNodeId !== input.nodeId || existing.ownerAgentId !== input.agentId) {

4218 return { ok: false, reason: "not_owner", current: existing };

4219 }

4220 this.db.prepare("DELETE FROM taskClaims WHERE projectId = ? AND taskId = ?").run(input.projectId, input.taskId);

4221 return { ok: true };

4222 });

4223 } catch (error) {

4224 throw new Error(`Failed to release task claim ${input.projectId}/${input.taskId}: ${error instanceof Error ? error.message : String(error)}`

4225 }

4226 }

4227 /**

4228 * Prepare a SQL statement. Returns a Statement object.

4229 */

4230 prepare(sql) {

4231 return this.db.prepare(sql);

4232 }

4233 /**

4234 * Execute a raw SQL string (no parameters).

4235 */

4236 exec(sql) {

4237 this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/chunk-4L6CLWJC.jsView on unpkg · L4235

4238 }

4239 /**

4240 * Get the last modification timestamp (epoch ms).

4241 * Returns 0 if the value is not set.

4242 */

4243 getLastModified() {

4244 const row = this.db.prepare("SELECT value FROM __meta WHERE key = 'lastModified'").get();

4245 if (!row)

4246 return 0;

4247 return parseInt(row.value, 10) || 0;

4248 }

4249 /**

4250 * Update the last modification timestamp to the current time.

4251 * Guarantees monotonicity: the new value is always strictly greater than

4252 * the previous value, even if called multiple times within the same millisecond.

4253 * Call this after every write operation to enable change detection polling.

4254 */

4255 bumpLastModified() {

Lines 4975-5015javascript

4975 this.name = "NoMatchError";

4976 Object.setPrototypeOf(this, _NoMatchError.prototype);

4977 }

4978};

4979async function isDirectoryExisting(directoryPath,

dist/chunk-AWKNRUOR.jsView file

Lines 643-683javascript

643

644Output Requirements:

645- Fast-bail: if Diff Scope contains no QA-relevant files, output {"verdict":"APPROVE","notes":"out of scope: QA"} immediately.

646-

bin.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

3import { constants } from "node:fs";

4import { access } from "node:fs/promises";

5import { dirname, resolve } from "node:path";

6import { fileURLToPath, pathToFileURL }

dist/chunk-PSDYB45U.jsView file

Lines 8-48javascript

8import { join as join2 } from "path";

9

10// ../core/dist/memory-backend.js

11import { readFile, writeFile, mkdir, access, constants, readdir, stat } from "fs/promises";

12import { existsSync } from "fs";

dist/plugins/fusion-plugin-compound-engineering/skills/ce-brainstorm/scripts/visual-probe-server.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/* global console, process, setInterval, setTimeout */

3import { execFileSync, spawn } from "node:child_process"

4import fs from "node:fs"

5import http from "node:http"

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView file

•path = dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.sh kind = build_helper sizeBytes = 12403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugins/fusion-plugin-compound-engineering/skills/ce-code-review/scripts/cross-model-adversarial-review.shView on unpkg

dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.jsView file

•path = dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.js kind = payload_in_excluded_dir sizeBytes = 6726679 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/plugins/fusion-plugin-whatsapp-chat/.bundled.reload-7.jsView on unpkg

dist/bin.jsView file

•path = dist/bin.js kind = oversized_source_file sizeBytes = 16622429 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.jsView on unpkg

•path = dist/bin.js kind = oversized_cli_entrypoint sizeBytes = 16622429 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.jsView on unpkg

dist/client/assets/cytoscape.esm-OyMbaexL.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/desktop/client/assets/cytoscape.esm-OyMbaexL.jsView on unpkg