@taurgis/bonsai@3.2.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@taurgis/bonsai@3.2.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 84-120json

84 "topicSeparator": " ",

85 "hooks": {

86 "command_not_found": "./dist/hooks/command-not-found/suggest.js"

87 },

88 "topics": {

89 "config": {

90 "description": "Manage research cache configuration"

91 }

92 }

93 },

94 "scripts": {

95 "build": "tsc -b && oclif manifest",

96 "changeset": "changeset",

97 "changeset:status": "changeset status --verbose",

98 "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.ts\"",

99 "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.ts\"",

100 "lint": "pnpm lint:eslint && pnpm lint:line-counts && pnpm lint:health",

101 "lint:eslint": "eslint \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.ts\" --max-warnings 0",

102 "lint:line-counts": "node scripts/check-line-counts.ts --all",

103 "lint:health": "pnpm test:coverage && pnpm exec fallow health --format human",

104 "postinstall": "node -e \"if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['forward-nexus', 'sync', '--pull'], { stdio: 'inherit' });\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L104

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L104

105 "publish:snapshot": "changeset version --snapshot snapshot && changeset publish --tag snapshot",

106 "release": "changeset publish",

107 "regression:suite": "tsc -b && node testing/regression/run-suite.mjs",

108 "regression:promote": "tsc -b && node testing/regression/run-suite.mjs --promote",

109 "regression:check": "tsc -b && node testing/regression/run-suite.mjs --strict",

110 "audit:cli": "node testing/manual-audit.mjs",

111 "nexus:sync": "npx forward-nexus update && npx forward-nexus sync",

112 "test": "vitest",

113 "test:coverage": "vitest run --coverage",

114 "type-check": "tsc --noEmit",

115 "version-packages": "changeset version",

116 "docs:dev": "vitepress dev docs",

117 "docs:build": "vitepress build docs",

118 "docs:preview": "vitepress preview docs"

119 }

120}

dist/lib/research/browser.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/research/browser.jsView on unpkg · L1

3import { execSync } from 'node:child_process';

4

package.json#scripts.postinstallView file

1if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['for...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

package.json#scripts.postinstallView on unpkg · L1

1if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['for...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

package.json#scripts.postinstallView on unpkg · L1

agents/hooks/claude-code/hooks/bonsai-web-fetch.shView file

•path = agents/hooks/claude-code/hooks/bonsai-web-fetch.sh kind = build_helper sizeBytes = 686 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/hooks/claude-code/hooks/bonsai-web-fetch.shView on unpkg