@tradeinsight-info/ti@0.2.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@tradeinsight-info/ti@0.2.1: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView file

12// generating it here (before `npm pack` in smoke:dist / the release) is enough. L13: import { execFileSync } from "node:child_process"; L14: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView on unpkg · L12

packages/ti-distribution/vendor/pi/dist/utils/tools-manager.jsView file

186const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }"; L187: const powershellFailure = runExtractionCommand("powershell.exe", [ L188: "-NoLogo",

High

Shell

Package source references shell execution.

packages/ti-distribution/vendor/pi/dist/utils/tools-manager.jsView on unpkg · L186

packages/ti-distribution/bin/ti.mjsView file

65// Launch pi L66: await import(pathToFileURL(join(pkgRoot(), "dist", "cli.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/ti-distribution/bin/ti.mjsView on unpkg · L65

packages/ti-distribution/vendor/pi/dist/modes/interactive/interactive-mode.jsView file

11Cross-file remote execution chain: packages/ti-[redacted]-mode.js spawns packages/ti-finance/dist/index.js; helper contains network access plus dynamic code execution. L11: import chalk from "chalk"; L12: import { spawn, spawnSync } from "child_process"; L13: import { APP_NAME, APP_TITLE, CONFIG_DIR_NAME, getAgentDir, getAuthPath, getDebugLogPath, getDocsPath, getShareViewerUrl, VERSION, } from "../../config.js"; ... L96: } L97: const ANTHROPIC_SUBSCRIPTION_AUTH_WARNING = "Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan l... L98: function isAnthropicSubscriptionAuthKey(apiKey) { ... L110: export function formatResumeCommand(sessionManager) { L111: if (!process.stdout.isTTY) L112: return undefined; ... L65

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

packages/ti-distribution/vendor/pi/dist/modes/interactive/interactive-mode.jsView on unpkg · L11

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView file

•path = packages/ti-[redacted]-vs-growth.backtest.py kind = build_helper sizeBytes = 1795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView on unpkg

packages/ti-distribution/vendor/pi/dist/core/tools/bash.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tradeinsight-info/ti@0.2.0 matchedIdentity = npm:QHRyYWRlaW5zaWdodC1pbmZvL3Rp:0.2.0 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/ti-distribution/vendor/pi/dist/core/tools/bash.jsView on unpkg

Source & flagged code

6 flagged

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Lock the release artifact's FULL transitive dependency tree.

3//

4// build-dist writes exact versions for the manifest's direct deps, but that alone

5// doesn't freeze deps-of-deps (e.g. pi's @earendil-works/* sub-packages reference

6// each other with caret ranges). npm honors a package's npm-shrinkwrap.json when

7// the package is installed AS A DEPENDENCY (unlike package-lock.json), so shipping

8// one freezes the entire closure deterministically. This mirrors upstream pi, which

9// ships a npm-shrinkwrap.json generated at prepublish.

10//

11// npm always packs npm-shrinkwrap.json into the tarball regardless of `files`, so

12// generating it here (before `npm pack` in smoke:dist / the release) is enough.

13import { execFileSync } from "node:child_process";

14import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView on unpkg · L12

15import { join } from "node:path";

16import { fileURLToPath } from "node:url";

17

18const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));

19const STAGE = join(REPO_ROOT, "dist-pkg");

20const NPM = process.platform === "win32" ? "npm.cmd" : "npm";

21

22if (!existsSync(join(STAGE, "package.json"))) {

23 console.error("[shrinkwrap-dist] dist-pkg/ not built — run build-dist first");

24 process.exit(1);

25}

26

27const run = (args) => execFileSync(NPM, args, { cwd: STAGE, stdio: "inherit" });

28

29// Resolve the full tree into package-lock.json without installing node_modules,

30// then convert it to npm-shrinkwrap.json (the dependency-honored lockfile).

31console.log("[shrinkwrap-dist] resolving full dependency tree");

32run(["install", "--package-lock-only", "--no-audit", "--no-fund"]);

packages/ti-distribution/vendor/pi/dist/utils/tools-manager.jsView file

Lines 166-206javascript

166}

167function getWindowsTarCommand() {

168 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

169 if (systemRoot) {

170

packages/ti-distribution/bin/ti.mjsView file

Lines 45-67javascript

45// Inject the hardcoded extension bundle (see bundle.mjs) with --no-extensions to

46// prevent settings/package-based extensions from loading. Only our entries load.

47//

48// Entry resolution: default to raw TS (dev, no build step). Set TI_DIST=1 to load

49// the built dist/index.js bundles (produced by `bun run build`) — used for

50// packaged delivery so we ship compiled JS instead of source.

51const finalArgs = buildBundleArgs(filtered, process.env.TI_DIST

packages/ti-distribution/vendor/pi/dist/modes/interactive/interactive-mode.jsView file

Lines 1-31javascript

1/**

2 * Interactive mode for the coding agent.

3 * Handles TUI rendering and user interaction, delegating business logic to AgentSession.

4 */

5import * as crypto from "node:crypto";

6import *

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView file

•path = packages/ti-[redacted]-vs-growth.backtest.py kind = build_helper sizeBytes = 1795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView on unpkg

packages/ti-distribution/vendor/pi/dist/core/tools/bash.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tradeinsight-info/ti@0.2.0 matchedIdentity = npm:QHRyYWRlaW5zaWdodC1pbmZvL3Rp:0.2.0 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/ti-distribution/vendor/pi/dist/core/tools/bash.jsView on unpkg