@spinabot/brigade@1.29.0: Clean npm security report (Allow)

Loading npm security reports…

@spinabot/brigade@1.29.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

26 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

64 "typecheck": "tsc -p tsconfig.json --noEmit",

65 "brigade": "node brigade.mjs",

66 "start": "node scripts/run-brigade.mjs",

67 "dev": "node scripts/run-brigade.mjs",

68 "dev:tsx": "tsx src/entry.ts",

69 "watch": "tsx --watch src/entry.ts",

70 "onboard": "node scripts/run-brigade.mjs onboard",

71 "login": "node scripts/run-brigade.mjs login",

72 "login:bin": "node brigade.mjs login",

73 "auth": "node scripts/run-brigade.mjs auth",

74 "onboard:bin": "node brigade.mjs onboard",

75 "onboard:watch": "tsx --watch src/entry.ts onboard",

76 "agent": "node scripts/run-brigade.mjs agent",

77 "agent:bin": "node brigade.mjs agent",

78 "agent:watch": "tsx --watch src/entry.ts agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

scripts/convex-dev.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// scripts/convex-dev.mjs

3//

4// Brigade local Convex orchestrator — fully air-gapped, zero cloud touch.

5// Spawns the self-hosted convex-local-backend binary + serves the dashboard

6// on 127.0.0.1:6791. Same path OSS users will use; no Convex account needed.

7//

8// npm run convex:dev

9//

10// Persists state under F:\Brigade\.convex-data\:

dist/infra/net/fetch-guard.jsView file

4* Why this exists: Brigade runs LLM-controllable URLs through `fetch`. L5: * Without a guard, a model can be tricked into hitting `http://169.254.169.254/` L6: * (cloud metadata) or `http://localhost:1234/` (developer service) and ... L20: import { isIP, isIPv4, isIPv6 } from "node:net"; L21: import { promises as dnsPromises } from "node:dns"; L22: import { DEFAULT_TIMEOUT_SECONDS } from "../../agents/tools/web-shared.js"; ... L28: * Cloud-metadata + forbidden-literal hosts that stay blocked EVEN WHEN L29: * `allowPrivateNetwork` is set — these are never a legitimate LAN target and are L30: * the highest-value SSRF destinations. ... L364: headers: currentHeaders, L365: body: currentBody ?? undefined, L366: redirect: "manual",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/security/injection-patterns.jsView file

58contains invisible/control Unicode U+200B (zero width space) const INVISIBLE_CODEPOINTS = /[<U+200B>-<U+200D><U+2060>⁢-⁤<U+FEFF><U+202A>-<U+202E><U+2066>-<U+2069>]/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/injection-patterns.jsView on unpkg · L58

scripts/convex-push.mjsView file

75console.log(`▌ Pushing convex/ functions → ${target}`); L76: const res = spawnSync("npx", ["convex", "deploy", "--yes"], { L77: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/convex-push.mjsView on unpkg · L75

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

scripts/assets/brigade-favicon.icoView file

•path = scripts/assets/brigade-favicon.ico kind = high_entropy_blob sizeBytes = 19371 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

scripts/assets/brigade-favicon.icoView on unpkg

dist/ui/brand-frames-cli.jsView file

•path = dist/ui/brand-frames-cli.js kind = oversized_source_file sizeBytes = 2475115 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/brand-frames-cli.jsView on unpkg

•path = dist/ui/brand-frames-cli.js kind = oversized_cli_entrypoint sizeBytes = 2475115 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/ui/brand-frames-cli.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.28.0 matchedPath = dist/agents/extensions/install-scan.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.28.0 matchedPath = dist/agents/extensions/install.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/core/daemon/launchd.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.28.0 matchedPath = dist/core/daemon/launchd.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

dist/core/daemon/schtasks.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.28.0 matchedPath = dist/core/daemon/schtasks.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.28.0 matchedPath = dist/core/tunnel/providers/bore.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/agents/channels/bluebubbles/account-config.d.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L35

dist/agents/channels/bluebubbles/account-config.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L35

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/brand-oauth-page.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

14*/ L15: import { spawn } from "node:child_process"; L16: import { getModels } from "@earendil-works/pi-ai";

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L14

dist/ui/clipboard.jsView file

18* Each platform expresses all four differently, so they live behind one L19: * `ClipboardBackend` and the rest of the product never learns that PowerShell, L20: * osascript, or wl-paste exist.

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L18

dist/agents/org/pride-image.jsView file

90// consistent with how Brigade lazy-loads other heavy modules.) L91: const importer = new Function("s", "return import(s)"); L92: const mod = (await importer("playwright-core"));

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/agents/org/pride-image.jsView on unpkg · L90

brigade.mjsView file

54try { L55: const mod = await import("node:module"); L56: if (typeof mod.enableCompileCache === "function" && !process.env.NODE_DISABLE_COMPILE_CACHE) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

brigade.mjsView on unpkg · L54

dist/agents/tool-loop-detector.jsView file

1/** L2: * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

dist/core/daemon/systemd.jsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L14: function unitPath() { L15: return path.join(os.homedir(), ".config", "systemd", "user", SERVICE_UNIT_NAME); L16: } ... L36: "RestartSec=2", L37: `StandardOutput=append:${ctx.stdoutPath}`, L38: `StandardError=append:${ctx.stderrPath}`, ... L74: if (r.code !== 0) { L75: return { ok: false, message: `systemctl enable failed: ${r.stderr.trim()}`, unitPath: file }; L76: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/daemon/systemd.jsView on unpkg · L8

scripts/convex-dev.mjsView file

16L17: import { spawn } from "node:child_process"; L18: import { mkdirSync, existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs"; L19: import { randomBytes } from "node:crypto"; L20: import { createServer } from "node:http"; L21: import { readFile, stat } from "node:fs/promises"; ... L30: // or `npm run convex:dev` from a checkout (→ <root>/.convex-data, the default). L31: const DATA_DIR = process.env.BRIGADE_CONVEX_DATA_DIR?.trim() || join(ROOT, ".convex-data"); L32: const DASHBOARD_DIR = join(BIN_DIR, "dashboard");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/convex-dev.mjsView on unpkg · L16

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/security/injection-patterns.jsView file

58contains invisible/control Unicode U+200B (zero width space) const INVISIBLE_CODEPOINTS = /[<U+200B>-<U+200D><U+2060>⁢-⁤<U+FEFF><U+202A>-<U+202E><U+2066>-<U+2069>]/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/injection-patterns.jsView on unpkg · L58

scripts/convex-push.mjsView file

75console.log(`▌ Pushing convex/ functions → ${target}`); L76: const res = spawnSync("npx", ["convex", "deploy", "--yes"], { L77: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/convex-push.mjsView on unpkg · L75

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

scripts/assets/brigade-favicon.icoView file

•path = scripts/assets/brigade-favicon.ico kind = high_entropy_blob sizeBytes = 19371 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

scripts/assets/brigade-favicon.icoView on unpkg

dist/ui/brand-frames-cli.jsView file

•path = dist/ui/brand-frames-cli.js kind = oversized_source_file sizeBytes = 2475115 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/brand-frames-cli.jsView on unpkg

•path = dist/ui/brand-frames-cli.js kind = oversized_cli_entrypoint sizeBytes = 2475115 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/ui/brand-frames-cli.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/core/daemon/launchd.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

dist/core/daemon/schtasks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/agents/channels/bluebubbles/account-config.d.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L35

dist/agents/channels/bluebubbles/account-config.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L35

Source & flagged code

26 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

64 "typecheck": "tsc -p tsconfig.json --noEmit",

65 "brigade": "node brigade.mjs",

66 "start": "node scripts/run-brigade.mjs",

67 "dev": "node scripts/run-brigade.mjs",

68 "dev:tsx": "tsx src/entry.ts",

69 "watch": "tsx --watch src/entry.ts",

70 "onboard": "node scripts/run-brigade.mjs onboard",

71 "login": "node scripts/run-brigade.mjs login",

72 "login:bin": "node brigade.mjs login",

73 "auth": "node scripts/run-brigade.mjs auth",

74 "onboard:bin": "node brigade.mjs onboard",

75 "onboard:watch": "tsx --watch src/entry.ts onboard",

76 "agent": "node scripts/run-brigade.mjs agent",

77 "agent:bin": "node brigade.mjs agent",

78 "agent:watch": "tsx --watch src/entry.ts agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

scripts/convex-dev.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// scripts/convex-dev.mjs

3//

4// Brigade local Convex orchestrator — fully air-gapped, zero cloud touch.

5// Spawns the self-hosted convex-local-backend binary + serves the dashboard

6// on 127.0.0.1:6791. Same path OSS users will use; no Convex account needed.

7//

8// npm run convex:dev

9//

10// Persists state under F:\Brigade\.convex-data\:

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/security/injection-patterns.jsView file

58contains invisible/control Unicode U+200B (zero width space) const INVISIBLE_CODEPOINTS = /[<U+200B>-<U+200D><U+2060>⁢-⁤<U+FEFF><U+202A>-<U+202E><U+2066>-<U+2069>]/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/injection-patterns.jsView on unpkg · L58

scripts/convex-push.mjsView file

75console.log(`▌ Pushing convex/ functions → ${target}`); L76: const res = spawnSync("npx", ["convex", "deploy", "--yes"], { L77: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/convex-push.mjsView on unpkg · L75

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

scripts/assets/brigade-favicon.icoView file

•path = scripts/assets/brigade-favicon.ico kind = high_entropy_blob sizeBytes = 19371 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

scripts/assets/brigade-favicon.icoView on unpkg

dist/ui/brand-frames-cli.jsView file

•path = dist/ui/brand-frames-cli.js kind = oversized_source_file sizeBytes = 2475115 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/brand-frames-cli.jsView on unpkg

•path = dist/ui/brand-frames-cli.js kind = oversized_cli_entrypoint sizeBytes = 2475115 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/ui/brand-frames-cli.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/core/daemon/launchd.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

dist/core/daemon/schtasks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/agents/channels/bluebubbles/account-config.d.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts

dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L35

dist/agents/channels/bluebubbles/account-config.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = * ch...}" }

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L28

34patternName = generic_password severity = medium line = 34 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L34

35patternName = generic_password severity = medium line = 35 matchedText = * ..." },

Medium

Secret Pattern

Hardcoded password in dist/agents/channels/bluebubbles/account-config.js

dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L35

@spinabot/brigade@1.29.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code