@sema-agent/core@1.320.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@sema-agent/core@1.320.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/core/session-store.jsView file

95} L96: async fork(sourceId, owner) { L97: let source;

High

Child Process

Package source references child process execution.

dist/core/session-store.jsView on unpkg · L95

dist/core/auto-promote.jsView file

30"/bin/bash", L31: "bash -c", L32: "sh -c",

High

Shell

Package source references shell execution.

dist/core/auto-promote.jsView on unpkg · L30

32"sh -c", L33: "eval(", L34: "Function(",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core/auto-promote.jsView on unpkg · L32

dist/core/auto-mode-prompt-assets.jsView file

1export const AUTO_MODE_BASE_PROMPT = "You are a security monitor for autonomous AI coding agents.\n\n## Context\n\nThe agent you are monitoring is an **autonomous coding agent** wi... L2: export const AUTO_MODE_PERMISSIONS_EXTERNAL = "## Environment\n\nThree kinds of slot. **Context slots** describe the user's setup (organization, stack, posture) so the rules below ... L3: //# sourceMappingURL=auto-mode-prompt-assets.js.map

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/core/auto-mode-prompt-assets.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js -> dist/core/auto-mode-prompt-assets.js L1: export const AUTO_MODE_BASE_PROMPT = "You are a security monitor for autonomous AI coding agents.\n\n## Context\n\nThe agent you are monitoring is an **autonomous coding agent** wi... L2: export const AUTO_MODE_PERMISSIONS_EXTERNAL = "## Environment\n\nThree kinds of slot. **Context slots** describe the user's setup (organization, stack, posture) so the rules below ... L3: //# sourceMappingURL=auto-mode-prompt-assets.js.map

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/core/auto-mode-prompt-assets.jsView on unpkg · L1

dist/engine/execution-env/kill-tree.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sema-agent/core@1.319.0 matchedIdentity = npm:QHNlbWEtYWdlbnQvY29yZQ:1.319.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine/execution-env/kill-tree.jsView on unpkg

Source & flagged code

6 flagged

dist/core/session-store.jsView file

Lines 75-115javascript

75 e.lastActiveAt = Date.now();

76 }

77 }

78 noteTaskRun(sessionId, taskId) {

79 const e = this.entries.get(sessionId);

80 if (e) {

81 e.lastTaskId = taskId;

82 e.lastActiveAt = Date.now();

83 }

84 }

85 async list() {

86 return [...this.entries.entries()]

87 .map(([sessionId, e]) => ({

88 sessionId,

89 lastActiveAt: e.lastActiveAt,

90 ...(e.createdAt !== undefined && e.createdAt !== "" ? { createdAt: e.createdAt } : {}),

91 ...(e.lastTaskId !== undefined ? { lastTaskId: e.lastTaskId } : {}),

92 ...(e.forkedFrom !== undefined ? { forkedFrom: e.forkedFrom } : {}),

93 }))

94 .sort((a, b) => b.lastActiveAt - a.lastActiveAt);

95 }

96 async fork(sourceId, owner) {

97 let source;

High

Child Process

Package source references child process execution.

dist/core/session-store.jsView on unpkg · L95

98 try {

99 source = await this.repo.open({ id: sourceId, createdAt: "" });

100 }

101 catch (err) {

102 if (isNotFound(err)) {

103 return null;

104 }

105 throw err;

106 }

107 const forkOptions = await settledForkOptions(source);

108 const forkParams = { ...forkOptions, id: uuidv7() };

109 if (owner != null) {

110 forkParams.owner = owner;

111 }

112 const forked = await this.repo.fork(await source.getMetadata(), forkParams);

113 const meta = await forked.getMetadata();

114 this.entries.set(meta.id, {

115 session: forked,

dist/core/auto-promote.jsView file

Lines 10-52javascript

10 return "needs_human";

11 const g1ok = i.oracle.protected && i.oracle.isolationClass === "out_of_process";

12 const g2ok = i.record.gate2Verdict

dist/core/auto-mode-prompt-assets.jsView file

Lines 1-3javascript

1export const AUTO_MODE_BASE_PROMPT = "You are a security monitor for autonomous AI coding agents.\n\n## Context\n\nThe agent you are monitoring is an **autonomous coding agent** with shell access, file system access, and API credentials. It operates with **permissions similar to a human developer** — it can push code, run infrastructure commands, and access internal services. These agents run **long-running tasks** (minutes to hours) where the user who started the agent may not be actively watching. The agent may operate in a **shared environment** — other people's jobs, services, and data may ...

2export const AUTO_MODE_PERMISSIONS_EXTERNAL

dist/engine/execution-env/kill-tree.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sema-agent/core@1.319.0 matchedIdentity = npm:QHNlbWEtYWdlbnQvY29yZQ:1.319.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine/execution-env/kill-tree.jsView on unpkg