@tianshu-ai/tianshu@0.5.5: Suspicious npm security report (Warn)

Loading npm security reports…

@tianshu-ai/tianshu@0.5.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

plugins/board/dist/runtime.jsView file

Lines 78-118javascript

78 if (done) return;

79 if (document.querySelector(sel)) {

80 done = true; obs.disconnect(); resolve(true);

81 }

82 });

83 obs.observe(document.body || document.documentElement, { childList: true, subtree: true });

84 setTimeout(function () {

85 if (done) return;

86 done = true; obs.disconnect();

87 reject(new Error('wait_for timed out: ' + sel));

88 }, timeoutMs || 5000);

89 });

90 }

92 async function execute(op) {

93 var a = op.action;

94 if (a === 'query') return readAttr($(op.selector), op.attr);

95 if (a === 'click') { $(op.selector).click(); return null; }

96 if (a === 'fill') { setFormValue($(op.selector), op.value); return null; }

97 if (a === 'wait_for') { await waitFor(op.selector, op.timeout_ms); return true; }

98 if (a === 'eval') {

99 var fn = new Function('return (async () => { ' + op.script + ' })()');

100 return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

plugins/board/dist/runtime.jsView on unpkg · L98

101 }

102 if (a === 'dump') return dump(op.selector, op.mode);

103 throw new Error('unknown action: ' + a);

104 }

105

106 window.addEventListener('message', async function (ev) {

107 if (ev.source !== window.parent) return;

108 var msg = ev.data;

109 if (!msg || msg.type !== 'tianshu:board_act') return;

110 try {

111 var data = await execute(msg.op || {});

112 window.parent.postMessage({ type: 'tianshu:board_act_response', reqId: msg.reqId, ok: true, data: data }, '*');

113 } catch (err) {

114 window.parent.postMessage({ type: 'tianshu:board_act_response', reqId: msg.reqId, ok: false, error: (err && err.message) || String(err) }, '*');

115 }

116 });

117

118 // Report our content height to the parent so a host that renders us

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

plugins/wechat/dist/server.jsView file

Lines 1-26javascript

1import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);

3// src/ilink-api.ts

4var STALE_TOKEN_ERRCODES

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

Source & flagged code

5 flagged · loading source

plugins/board/dist/runtime.jsView file

98if (a === 'eval') { L99: var fn = new Function('return (async () => { ' + op.script + ' })()'); L100: return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

plugins/board/dist/runtime.jsView on unpkg · L98

bin/tianshu.mjsView file

29L30: const { main } = await import(distEntry); L31: const code = await main(process.argv.slice(2));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tianshu.mjsView on unpkg · L29

plugins/wechat/dist/server.jsView file

6var DEFAULT_LONG_POLL_TIMEOUT_MS = 35e3; L7: var ILINK_BASE_URL = "https://ilinkai.weixin.qq.com"; L8: var TIANSHU_BOT_AGENT = "tianshu"; ... L62: if (!res.ok) { L63: const body = await res.text().catch(() => ""); L64: throw classifyAndThrow({ type: "non200", status: res.status, body }); ... L96: headers, L97: body: opts.body, L98: signal: controller.signal ... L570: // what's happening inside the long-poll loop without tail-ing L571: // server stdout. Reset on each start(). L572: stats = {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/wechat/dist/server.jsView on unpkg · L6

packages/server/dist/setup/start-server.jsView file

21import fs from "node:fs"; L22: import net from "node:net"; L23: import os from "node:os"; ... L36: // typically run `tianshu setup` from their home dir, so L37: // process.cwd() won't be the repo. Walk up from this module's L38: // location until we hit a package.json named L39: // '@tianshu-ai/tianshu' (or run out of parents). ... L50: ? path.join(repoRoot, ".env") L51: : path.join(process.env.TIANSHU_HOME ?? L52: path.join(process.env.HOME ?? "", ".tianshu"), ".env")); ... L137: if (!r.ok) { L138: p.log.error(`launchctl kickstart failed: ${r.stderr ?? "(unknown)"}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/server/dist/setup/start-server.jsView on unpkg · L21

plugins/web-search/dist/tools/web-fetch.jsView file

1// `web_fetch(url, extractMode?, maxChars?)`. L2: // ... L14: // L15: // SSRF: we block private / loopback / link-local / metadata hosts L16: // before fetching AND re-check after redirects, so an agent can't ... L93: const ctype = res.headers.get("content-type") ?? ""; L94: const body = await res.text(); L95: let out; ... L110: text, L111: data: { L112: url,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

plugins/web-search/dist/tools/web-fetch.jsView on unpkg · L1

Source & flagged code

5 flagged

plugins/board/dist/runtime.jsView file

Lines 78-118javascript

78 if (done) return;

79 if (document.querySelector(sel)) {

80 done = true; obs.disconnect(); resolve(true);

81 }

82 });

83 obs.observe(document.body || document.documentElement, { childList: true, subtree: true });

84 setTimeout(function () {

85 if (done) return;

86 done = true; obs.disconnect();

87 reject(new Error('wait_for timed out: ' + sel));

88 }, timeoutMs || 5000);

89 });

90 }

92 async function execute(op) {

93 var a = op.action;

94 if (a === 'query') return readAttr($(op.selector), op.attr);

95 if (a === 'click') { $(op.selector).click(); return null; }

96 if (a === 'fill') { setFormValue($(op.selector), op.value); return null; }

97 if (a === 'wait_for') { await waitFor(op.selector, op.timeout_ms); return true; }

98 if (a === 'eval') {

99 var fn = new Function('return (async () => { ' + op.script + ' })()');

100 return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

plugins/board/dist/runtime.jsView on unpkg · L98

101 }

102 if (a === 'dump') return dump(op.selector, op.mode);

103 throw new Error('unknown action: ' + a);

104 }

105

106 window.addEventListener('message', async function (ev) {

107 if (ev.source !== window.parent) return;

108 var msg = ev.data;

109 if (!msg || msg.type !== 'tianshu:board_act') return;

110 try {

111 var data = await execute(msg.op || {});

112 window.parent.postMessage({ type: 'tianshu:board_act_response', reqId: msg.reqId, ok: true, data: data }, '*');

113 } catch (err) {

114 window.parent.postMessage({ type: 'tianshu:board_act_response', reqId: msg.reqId, ok: false, error: (err && err.message) || String(err) }, '*');

115 }

116 });

117

118 // Report our content height to the parent so a host that renders us

bin/tianshu.mjsView file

Lines 9-33javascript

9// We resolve the dist path *relative to this file* rather than the

10// CWD so the bin works regardless of where the user runs it from

11// (npm install -g lands this in /usr/local/bin or similar; the

12// dist sits a few dirs up).

14import { fileURLToPath } from "node:url";

15import { dirname, resolve } from "node:path";

plugins/wechat/dist/server.jsView file

Lines 1-26javascript

1import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);

3// src/ilink-api.ts

4var STALE_TOKEN_ERRCODES

packages/server/dist/setup/start-server.jsView file

Lines 1-41javascript

1// Final setup step: pick ports, install + load a launchd agent

2// (macOS) or fall back to a manual command (other platforms),

3// verify /api/health responds.

4//

5// Why launchd rather than a foreground spawn:

6// - it survives terminal close, reboot, crashes (KeepAlive)

7// - it's the documented permanent-install path on macOS (see

8// docs/running.md), so the wizard producing the same plist

9// means there's only one way to run tianshu in dev/prod

10// - cross-platform we still fall back to telling the user the

plugins/web-search/dist/tools/web-fetch.jsView file

Lines 1-21javascript

1// `web_fetch(url, extractMode?, maxChars?)`.

2//

3// A plain HTTP GET that extracts readable content and returns it

4// as markdown or text. No JavaScript execution, no API key, no

5// external service — this is the "grab a single page" capability

6// that pairs with web_search. For JS-heavy or login-gated pages

7// the agent should use the browser tool instead.

8//

9// Dependency-free on purpose: the plugin ships without turndown /

10// readability so it stays a tiny self-contained builtin. The

@tianshu-ai/tianshu@0.5.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code