@solidnumber/cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@solidnumber/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

1032// and error handling. Sync exec so the parent doesn't double-print help. L1033: const { spawnSync } = require('child_process'); L1034: spawnSync(process.execPath, [process.argv[1], 'setup'], {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1032

dist/lib/esm-import.jsView file

18*/ L19: const dynamicEsmImport = new Function('specifier', 'return import(specifier)'); L20: function importESM(specifier) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/esm-import.jsView on unpkg · L18

dist/commands/completion.jsView file

9Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/commands/completion.js L9: * L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L184: const path = require('path'); L185: const shell = (process.env.SHELL || '').toLowerCase(); L186: const home = os.homedir(); L187: if (shell.includes('fish')) { ... L278: .description('Generate or install shell completion (reflects the live command tree)') L279: .option('--bash', 'Generate bash completion to stdout') L280: .option('--fish', 'Generate fish completion to stdout')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/completion.jsView on unpkg · L9

9* L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L184: const path = require('path'); L185: const shell = (process.env.SHELL || '').toLowerCase(); L186: const home = os.homedir(); L187: if (shell.includes('fish')) { ... L278: .description('Generate or install shell completion (reflects the live command tree)') L279: .option('--bash', 'Generate bash completion to stdout') L280: .option('--fish', 'Generate fish completion to stdout')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/completion.jsView on unpkg · L9

dist/commands/app.js#virtual:normalized:round1View file

66/** Which commit of which repository a folder is, when it can be known. Pure but for git. */ L67: function buildSource(cwd, env = process.env) { L68: // In GitHub Actions both are given; they name the commit the workflow checked out. ... L71: if (!commit) { L72: const head = (0, child_process_1.spawnSync)("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }); L73: // Only when the folder"s tree is clean: a commit that is not what was built would be a lie.\n const dirty = (0, child_process_1.spawnSync)("git", ["status", "--porcelain"],... L74: for (const f of files) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/app.js#virtual:normalized:round1View on unpkg · L66

71if (!commit) { L72: const head = (0, child_process_1.spawnSync)("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }); L73: // Only when the folder"s tree is clean: a commit that is not what was built would be a lie.\n const dirty = (0, child_process_1.spawnSync)("git", ["status", "--porcelain"],... L74: for (const f of files) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/app.js#virtual:normalized:round1View on unpkg · L71

71Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/commands/app.js L71: if (!commit) { L72: const head = (0, child_process_1.spawnSync)("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }); L73: // Only when the folder"s tree is clean: a commit that is not what was built would be a lie.\n const dirty = (0, child_process_1.spawnSync)("git", ["status", "--porcelain"],... L74: for (const f of files) {

dist/lib/first-run.jsView file

56const telemetry_1 = require("./telemetry"); L57: const CONFIG_DIR = path.join(os.homedir(), '.solid'); L58: const IDENTITY_FILE = path.join(CONFIG_DIR, 'identity.json'); L59: function shouldSkip() { L60: if (process.env.SOLID_DISABLE_TELEMETRY === '1') L61: return true; L62: if (process.env.CI) L63: return true; ... L76: return null; L77: return JSON.parse(fs.readFileSync(IDENTITY_FILE, 'utf-8')); L78: } ... L99: function getApiBase() {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/lib/first-run.jsView on unpkg · L56

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/first-run.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/first-run.jsView on unpkg

dist/commands/visual.jsView file

21exports.visualCommand = void 0; L22: const child_process_1 = require("child_process"); L23: const chalk_1 = __importDefault(require("chalk")); ... L26: if (host) { L27: return host.startsWith('http') ? host : `https://${host}`; L28: } ... L30: // fall back to prod. Local dev users: SOLID_WEB_URL=http://localhost:3000 L31: const env = process.env.SOLID_WEB_URL || L32: (process.env.SOLID_API_URL ? process.env.SOLID_API_URL.replace('//api.', '//app.') : ''); ... L35: function openInBrowser(url) { L36: const platform = process.platform; L37: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start ""' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/visual.jsView on unpkg · L21

dist/commands/context.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: lve().then(() => __importstar(require('../lib/commerce-skill'))); installcommerceskill(process.cwd()); let jsonldpath = null; let jsonldbytes = 0; if (jsonlddoc) { jsonldpath = path.join(writeres.librarydir, '..', 'solid-context.jsonld'); fs.writefilesync(jsonldpath, jsonlddoc); jsonldbytes = buffer.bytelength(jsonlddoc, 'utf-8'); } if (options.iftenant || process.argv.includes('--raw')) { spinner?.stop()

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/context.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. w')) { spinner?.stop(); process.stdout.write((0, context_ladder_1.hooksessiontext)((0, context_ladder_1.pinnednotesfromspine)(spineres), writeres.spinepath)); return; } spinner?.succeed(chalk_1.default.green('ai context library ready')); printladdernextsteps(writeres, jsonpath, jsondoc ? buffer.bytelength(jsondoc, 'utf-8') : 0, jsonldpath, jsonldbytes); return; } catch (error) { spinner?.fail(chalk_1.default.red('failed to build ddc library')); console.

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/open.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/open.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/open.jsView on unpkg

dist/commands/demo.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/demo.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/demo.jsView on unpkg

dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/serve.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/serve.jsView on unpkg

dist/commands/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/feedback.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/feedback.jsView on unpkg

dist/lib/offline-queue.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/offline-queue.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/offline-queue.jsView on unpkg

dist/commands/bids.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/bids.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/bids.jsView on unpkg

dist/commands/chains.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/chains.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/chains.jsView on unpkg

dist/commands/docs.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/docs.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/docs.jsView on unpkg

dist/commands/explore.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/explore.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/explore.jsView on unpkg

dist/commands/graph.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/graph.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/graph.jsView on unpkg

dist/commands/inbound.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/inbound.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/inbound.jsView on unpkg