@techierathore/techieflow@1.0.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@techierathore/techieflow@1.0.1: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

scripts/install.mjsView file

•path = scripts/install.mjs kind = trigger_reachable_excluded_payload sizeBytes = 52853 triggerReachableSource = scripts/install.mjs excludedPayload = .tfcore/utils/tf-gitignore-audit.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

scripts/install.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. templates) .claude/commands/ ← claude code slash commands (techieflow agents) .claude/settings.json ← yolo-except-git-writes permissions workflow.html ← the human workflow guide (open in a browser; §17 = macos / windows / linux) opencode.jsonc ← opencode config (loads agents/tasks from .tfcore/ via {file:...} refs) .gitignore ← framework entries appended (deployed copies stay uncommitted) tests/playwright/ tests/unit/ src/ all techieflow templates the analyst will need live locally in this project under: .tfcore/templates/v4custom/ so the project is portable — copy this whole tree to another machi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.mjsView on unpkg

.tfcore/utils/tf-goal.shView file

•path = .tfcore/utils/tf-goal.sh kind = payload_in_excluded_dir sizeBytes = 22101 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.tfcore/utils/tf-goal.shView on unpkg

•path = .tfcore/utils/tf-goal.sh kind = build_helper sizeBytes = 22101 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.tfcore/utils/tf-goal.shView on unpkg

scripts/install.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged

scripts/install.mjsView file

•path = scripts/install.mjs kind = trigger_reachable_excluded_payload sizeBytes = 52853 triggerReachableSource = scripts/install.mjs excludedPayload = .tfcore/utils/tf-gitignore-audit.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

scripts/install.mjsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. templates) .claude/commands/ ← claude code slash commands (techieflow agents) .claude/settings.json ← yolo-except-git-writes permissions workflow.html ← the human workflow guide (open in a browser; §17 = macos / windows / linux) opencode.jsonc ← opencode config (loads agents/tasks from .tfcore/ via {file:...} refs) .gitignore ← framework entries appended (deployed copies stay uncommitted) tests/playwright/ tests/unit/ src/ all techieflow templates the analyst will need live locally in this project under: .tfcore/templates/v4custom/ so the project is portable — copy this whole tree to another machi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install.mjsView on unpkg

.tfcore/utils/tf-goal.shView file

•path = .tfcore/utils/tf-goal.sh kind = payload_in_excluded_dir sizeBytes = 22101 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.tfcore/utils/tf-goal.shView on unpkg

•path = .tfcore/utils/tf-goal.sh kind = build_helper sizeBytes = 22101 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.tfcore/utils/tf-goal.shView on unpkg

scripts/install.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install.mjs#virtual:normalized:round1View on unpkg