@tea-agent/loop-agent: Clean npm security report (Allow)

Loading npm security reports…

Source & flagged code

3 flagged

bin/loop-agent.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { existsSync } from "node:fs";

3import { dirname, join } from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

6const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));

7const cliEntry = join(packageRoot, "dist", "cli.js");

9if (!existsSync(cliEntry)) {

10 console.error(

11 `loop-agent: cannot find built CLI at ${cliEntry}. Run \`npm run build\` before using the package bin.`,

12 );

13 process.exit(1);

14}

16try {

17 await import(pathToFileURL(cliEntry).href);

18} catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loop-agent.jsView on unpkg · L16

19 console.error(error instanceof Error ? error.message : String(error));

20 process.exit(1);

21}

scripts/kb-graph-incremental-prepare.shView file

•path = scripts/kb-graph-incremental-prepare.sh kind = build_helper sizeBytes = 254 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/kb-graph-incremental-prepare.shView on unpkg

dist/executors/shell-executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tea-agent/loop-agent@0.11.0 matchedIdentity = npm:QHRlYS1hZ2VudC9sb29wLWFnZW50:0.11.0 similarity = 0.475 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/executors/shell-executor.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/loop-agent.jsView file

16try { L17: await import(pathToFileURL(cliEntry).href); L18: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loop-agent.jsView on unpkg · L16

scripts/kb-graph-incremental-prepare.shView file

•path = scripts/kb-graph-incremental-prepare.sh kind = build_helper sizeBytes = 254 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/kb-graph-incremental-prepare.shView on unpkg

dist/executors/shell-executor.jsView file

•

@tea-agent/loop-agent: Clean npm security report (Allow) | LPM Firewall

@tea-agent/loop-agent@0.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code