@tonyclaw/agent-inspector@3.1.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@tonyclaw/agent-inspector@3.1.1: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 83-123json

83 "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",

84 "compatibility:compare": "node scripts/compatibility/cli.mjs compare",

85 "compatibility:drift": "node scripts/check-backend-compatibility.mjs",

86 "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",

87 "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",

88 "compatibility:run": "node scripts/compatibility/cli.mjs run",

89 "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",

90 "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",

91 "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",

92 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

93 "rust:build-package": "node scripts/rust/build-platform.mjs",

94 "rust:stage-package": "node scripts/rust/stage-platform.mjs",

95 "rust:verify-package": "node scripts/rust/verify-platform.mjs",

96 "rust:pack-package": "node scripts/rust/pack-platform.mjs",

97 "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",

98 "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",

99 "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",

100 "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",

101 "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",

102 "themes:generate": "node scripts/generate-theme-scales.mjs",

103 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L103

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L103

104 "prepublishOnly": "node scripts/rust/require-release-orchestrator.mjs",

105 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",

106 "lint": "eslint . --cache --cache-location .cache/eslintcache",

107 "format": "biome format --write .",

108 "format:check": "biome format .",

109 "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",

110 "extension:zip": "node scripts/pack-chrome-extension.mjs",

111 "extension:release": "node scripts/release-chrome-extension.mjs",

112 "release": "node scripts/release.mjs",

113 "knip": "knip",

114 "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",

115 "prepare": "husky",

116 "ladle": "ladle serve",

117 "ladle:build": "ladle build"

118 },

119 "dependencies": {

120 "@mariozechner/pi-agent-core": "^0.73.1",

121 "@mariozechner/pi-ai": "^0.73.1",

122 "@modelcontextprotocol/server": "^2.0.0-beta.4",

123 "@tailwindcss/typography": "^0.5.20",

scripts/setup-windows-runtime.mjsView file

Lines 1-26javascript

1import { copyFile, mkdir, readFile } from "node:fs/promises";

2import { existsSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path"

src/proxy/alerts.tsView file

Lines 32-72typescript

32export type ListAlertsOptions = AlertFilters & {

33 limit?: number;

34 scanLimit?: number;

35};

.output/ui/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/ui/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/ui/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/cli.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@3.0.46 matchedIdentity = npm:[redacted]:3.0.46 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg