@tea-agent/loop-agent@0.11.0: Suspicious npm security report

Loading npm security reports…

@tea-agent/loop-agent@0.11.0: Suspicious npm security report | LPM Firewall

Source & flagged code

3 flagged

bin/loop-agent.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { existsSync } from "node:fs";

3import { dirname, join } from "node:path";

4import { fileURLToPath, pathToFileURL } from "node:url";

6const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));

7const cliEntry = join(packageRoot, "dist", "cli.js");

9if (!existsSync(cliEntry)) {

10 console.error(

11 `loop-agent: cannot find built CLI at ${cliEntry}. Run \`npm run build\` before using the package bin.`,

12 );

13 process.exit(1);

14}

16try {

17 await import(pathToFileURL(cliEntry).href);

18} catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loop-agent.jsView on unpkg · L16

19 console.error(error instanceof Error ? error.message : String(error));

20 process.exit(1);

21}

scripts/check-task-pool-root.shView file

•path = scripts/check-task-pool-root.sh kind = build_helper sizeBytes = 1028 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-task-pool-root.shView on unpkg

dist/cli/update/npm-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tea-agent/loop-agent@0.7.4 matchedIdentity = npm:QHRlYS1hZ2VudC9sb29wLWFnZW50:0.7.4 similarity = 0.550 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/update/npm-client.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/loop-agent.jsView file

16try { L17: await import(pathToFileURL(cliEntry).href); L18: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loop-agent.jsView on unpkg · L16

scripts/check-task-pool-root.shView file

•path = scripts/check-task-pool-root.sh kind = build_helper sizeBytes = 1028 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-task-pool-root.shView on unpkg

dist/cli/update/npm-client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/update/npm-client.jsView on unpkg

@tea-agent/loop-agent@0.11.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code