@tencent-ai/agent-sdk@0.3.222: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@tencent-ai/agent-sdk@0.3.222: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

cli/dist/web-ui/assets/index-DyH2OU18.jsView file

909`);R.forEach(function(H,G){var T=s&&h.length+n,x={type:"text",value:"".concat(H,` L910: `)};if(G===0){var I=u.slice(p+1,m).concat(rd({children:[x],className:S.properties.className})),E=y(I,T);h.push(E)}else if(G===R.length-1){var M=u[m+1]&&u[m+1].children&&u[m+1].chil... L911: ?|

High

Child Process

Package source references child process execution.

cli/dist/web-ui/assets/index-DyH2OU18.jsView on unpkg · L909

7`);i=c.pop()||"";for(const d of c){const u=d.split(` L8: `);let h="";for(const p of u)p.startsWith("data: ")&&(h+=p.substring(6));if(h)try{const p=JSON.parse(h);this.handleMessage(p)}catch{}}}}finally{r.releaseLock()}}handleMessage(t){if... L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/web-ui/assets/index-DyH2OU18.jsView on unpkg · L7

cli/vendor/shim/broker-ipc-client.cjsView file

9L10: const net = require('net'); L11: const { spawnSync } = require('child_process'); L12: ... L15: function brokerTimeoutMs() { L16: const parsed = Number.parseInt(process.env.CODEBUDDY_SANDBOX_BROKER_TIMEOUT_MS || '', 10); L17: return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/vendor/shim/broker-ipc-client.cjsView on unpkg · L9

cli/vendor/genie-trash/linux-arm64View file

•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg

cli/dist/wasm/tree-sitter.wasmView file

•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg

cli/vendor/shim/native/binding.gypView file

•path = cli/vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/native/binding.gypView on unpkg

cli/dist/codebuddy-headless.jsView file

•path = cli/dist/codebuddy-headless.js kind = oversized_source_file sizeBytes = 16353527 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli/dist/codebuddy-headless.jsView on unpkg

Source & flagged code

7 flagged

cli/dist/web-ui/assets/index-DyH2OU18.jsView file

909`);R.forEach(function(H,G){var T=s&&h.length+n,x={type:"text",value:"".concat(H,` L910: `)};if(G===0){var I=u.slice(p+1,m).concat(rd({children:[x],className:S.properties.className})),E=y(I,T);h.push(E)}else if(G===R.length-1){var M=u[m+1]&&u[m+1].children&&u[m+1].chil... L911: ?|

High

Child Process

Package source references child process execution.

cli/dist/web-ui/assets/index-DyH2OU18.jsView on unpkg · L909

7`);i=c.pop()||"";for(const d of c){const u=d.split(` L8: `);let h="";for(const p of u)p.startsWith("data: ")&&(h+=p.substring(6));if(h)try{const p=JSON.parse(h);this.handleMessage(p)}catch{}}}}finally{r.releaseLock()}}handleMessage(t){if... L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/web-ui/assets/index-DyH2OU18.jsView on unpkg · L7

cli/vendor/shim/broker-ipc-client.cjsView file

Lines 1-29javascript

1/**

2 * Neutral broker IPC client for vendor shims.

3 *

4 * Owns JSON-line socket transport only. Runtime-specific request semantics and

5 * response classification stay in the caller.

6 */

7

8'use strict';

9

10const net = require('net');

cli/vendor/genie-trash/linux-arm64View file

•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg

cli/dist/wasm/tree-sitter.wasmView file

•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg

cli/vendor/shim/native/binding.gypView file

•path = cli/vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/native/binding.gypView on unpkg

cli/dist/codebuddy-headless.jsView file

•path = cli/dist/codebuddy-headless.js kind = oversized_source_file sizeBytes = 16353527 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli/dist/codebuddy-headless.jsView on unpkg