@thed24/pi-ui: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@thed24/pi-ui: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

bin/pifrontier.tsView file

24Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L24: L25: const pkgPath = new URL('../package.json', import.meta.url); L26: const packageRoot = dirname(fileURLToPath(pkgPath)); L27: const pkg = JSON.parse(readFileSync(fileURLToPath(pkgPath), 'utf8')) as { name: string; version: string }; L28: ... L35: function shellCommand(command: string): string[] { L36: return process.platform === 'win32' L37: ? ['cmd', '/d', '/s', '/c', command] ... L44: cwd, L45: env: process.env as Record<string, string>, L46: stdout: 'inherit', L47: stderr: 'inherit',

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/pifrontier.tsView on unpkg · L24

196// natively supported by Bun's readline implementation. L197: const { createInterface } = await import('readline'); L198: const rl = createInterface({ input: process.stdin, terminal: false });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pifrontier.tsView on unpkg · L196

build/client/service-worker.js.gzView file

•path = build/client/service-worker.js.gz kind = compressed_blob sizeBytes = 1042 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/service-worker.js.gzView on unpkg

build/client/_app/immutable/nodes/4.aYsjbJ4a.js.brView file

•path = build/client/_app/immutable/nodes/4.aYsjbJ4a.js.br kind = high_entropy_blob sizeBytes = 91890 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/4.aYsjbJ4a.js.brView on unpkg

server.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @thed24/pi-ui@0.8.1 matchedIdentity = npm:QHRoZWQyNC9waS11aQ:0.8.1 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server.tsView on unpkg

Source & flagged code

5 flagged

bin/pifrontier.tsView file

Lines 4-44typescript

4 *

5 * Usage:

6 * pi-ui [options]

7 * pi-ui update

8 *

9 * Options:

10 * -p, --password <password> Password to protect the UI (or set PI_PASSWORD env var)

11 * -P, --port <port> Port to listen on (default: 3000, or PORT env var)

12 * --cwd <dir> Working directory for the pi session (default: cwd)

13 * -o, --open Open the browser after startup

14 * -h, --help Show this help message

15 * -V, --version Print version and exit

16 */

17

18import { parseArgs } from 'util';

19import { dirname, resolve } from 'node:path';

20import { existsSync, readFileSync, writeFileSync } from 'node:fs';

21import { fileURLToPath } from 'node:url';

22

23// ── Version ───────────────────────────────────────────────────────────────────

24

25const pkgPath = new URL('../package.json', import.meta.url);

26const packageRoot = dirname(fileURLToPath(pkgPath));

27const pkg = JSON.parse(readFileSync(fileURLToPath(pkgPath), 'utf8')) as { name: string; version: string };

28

29type PackageManager = 'npm' | 'bun' | 'pnpm' | 'yarn';

30

31function quoteCommand(args: string[]): string {

32 return args.map((arg) => (/\s/.test(arg) ? JSON.stringify(arg) : arg)).join(' ');

33}

34

35function shellCommand(command: string): string[] {

36 return process.platform === 'win32'

37 ? ['cmd', '/d', '/s', '/c', command]

38 : ['sh', '-lc', command];

39}

40

41async function runUpdateStep(args: string[], cwd = packageRoot): Promise<void> {

42 console.log(`$ ${quoteCommand(args)}`);

43 const proc = Bun.spawn(args, {

44 cwd,

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/pifrontier.tsView on unpkg · L24

Lines 176-216typescript

176}

177

178if (command === 'update') {

179 try {

180 await updatePiUi();

181 console.log('pi-ui update completed. Restart pi-ui to load the new version.');

182 process.exit(

build/client/service-worker.js.gzView file

•path = build/client/service-worker.js.gz kind = compressed_blob sizeBytes = 1042 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/service-worker.js.gzView on unpkg

build/client/_app/immutable/nodes/4.aYsjbJ4a.js.brView file

•path = build/client/_app/immutable/nodes/4.aYsjbJ4a.js.br kind = high_entropy_blob sizeBytes = 91890 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/4.aYsjbJ4a.js.brView on unpkg

server.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @thed24/pi-ui@0.8.1 matchedIdentity = npm:QHRoZWQyNC9waS11aQ:0.8.1 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server.tsView on unpkg