@tritard/waterbrother@0.17.4: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@tritard/waterbrother@0.17.4: Suspicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

src/codebase-index.jsView file

3import { shouldSkipCodebaseIndex } from "./ios-attach-contract.js"; L4: import { execFile } from "node:child_process"; L5: import { promisify } from "node:util"; ... L249: const raw = await fs.readFile(indexPath, "utf8"); L250: existingIndex = JSON.parse(raw); L251: } catch {}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/codebase-index.jsView on unpkg · L3

src/listen-agent.jsView file

3Trigger-reachable persistence chain: scripts.start -> bin/waterbrother.js -> src/cli.js -> src/listen-agent.js L3: import path from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L9: export function agentPlistPath() { L10: return path.join(os.homedir(), "Library/LaunchAgents", `${LABEL}.plist`); L11: } ... L13: export async function installListenAgent() { L14: if (process.platform !== "darwin") { L15: throw new Error("Launch agent install is macOS only."); ... L22: const fallbackPath = [path.dirname(node), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(path.delimiter); L23: const rawPath = process.env.PATH L24: ? `${path.dirname(node)}${path.delimiter}${process.env.PATH}`

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/listen-agent.jsView on unpkg · L3

3import path from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L9: export function agentPlistPath() { L10: return path.join(os.homedir(), "Library/LaunchAgents", `${LABEL}.plist`); L11: } ... L13: export async function installListenAgent() { L14: if (process.platform !== "darwin") { L15: throw new Error("Launch agent install is macOS only."); ... L22: const fallbackPath = [path.dirname(node), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(path.delimiter); L23: const rawPath = process.env.PATH L24: ? `${path.dirname(node)}${path.delimiter}${process.env.PATH}`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/listen-agent.jsView on unpkg · L3

src/cli.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; ... L137: const BIN_PATH = path.join(PACKAGE_ROOT, "bin", "waterbrother.js"); L138: const DOCS_BASE_URL = String(process.env.WATERBROTHER_DOCS_BASE_URL || "https://waterbrother.app").trim().replace(/\/+$/, ""); L139: const TELEGRAM_BRIDGE_SERVICE = "telegram"; ... L540: } L541: return Buffer.concat(chunks).toString("utf8").trim(); L542: } ... L661: let codeLineNo = 1; L662: const columns = clampColumns(process.stdout.columns || 100); L663: const contentWidth = Math.max(20, columns - (ASSISTANT_PREFIX.length + 4)); ... L1067: const clearLine = () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/cli.jsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> bin/waterbrother.js -> src/cli.js L1: import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; ... L137: const BIN_PATH = path.join(PACKAGE_ROOT, "bin", "waterbrother.js"); L138: const DOCS_BASE_URL = String(process.env.WATERBROTHER_DOCS_BASE_URL || "https://waterbrother.app").trim().replace(/\/+$/, ""); L139: const TELEGRAM_BRIDGE_SERVICE = "telegram"; ... L540: } L541: return Buffer.concat(chunks).toString("utf8").trim(); L542: } ... L661: let codeLineNo = 1; L662: const columns = clampColumns(process.stdout.columns || 100); L663: const contentWidth = Math.max(20, columns - (ASSISTANT_PREFIX.length + 4)); ... L1067: const clearLine = () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/cli.jsView on unpkg · L1

src/tsnet-join.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import { createWriteStream } from "node:fs"; ... L16: L17: export function tsnetHome(home = os.homedir()) { L18: return path.join(home, ".waterbrother", "tsnet"); ... L28: L29: export function linuxTarballURL({ arch = process.arch, version = TSNET_VERSION } = {}) { L30: const cpu = arch === "arm64" ? "arm64" : "amd64"; L31: return `https://pkgs.tailscale.com/stable/tailscale_${version}_${cpu}.tgz`; L32: } ... L64: env: opts.env L65: }).then((result) => String(typeof result === "string" ? result : result?.stdout || "").trim());

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tsnet-join.jsView on unpkg · L1

src/acp-proxy.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/acp-proxy.js#virtual:string-array:round1View on unpkg

Source & flagged code

10 flagged

src/codebase-index.jsView file

Lines 1-23javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { shouldSkipCodebaseIndex } from "./ios-attach-contract.js";

4import { execFile } from "node:child_process";

5import { promisify } from "node:util";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/codebase-index.jsView on unpkg · L3

6import { createHash } from "node:crypto";

7

8const exec = promisify(execFile);

9

10/**

11 * Codebase indexing — pre-index the project so the model gets

12 * relevant context, not the whole file.

13 *

14 * Cursor uses tree-sitter + embeddings + vector DB.

15 * WB starts simpler: function/class chunking via regex + TF-IDF

16 * relevance scoring. No external dependencies.

17 *

18 * The index lives in .waterbrother/index.json and is incrementally

19 * updated via content hashing (only re-index changed files).

20 */

21

22const INDEX_DIR = ".waterbrother";

23const INDEX_FILE = "codebase-index.json";

src/listen-agent.jsView file

Lines 1-23javascript

1import fs from "node:fs/promises";

2import os from "node:os";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

src/cli.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; ... L137: const BIN_PATH = path.join(PACKAGE_ROOT, "bin", "waterbrother.js"); L138: const DOCS_BASE_URL = String(process.env.WATERBROTHER_DOCS_BASE_URL || "https://waterbrother.app").trim().replace(/\/+$/, ""); L139: const TELEGRAM_BRIDGE_SERVICE = "telegram"; ... L540: } L541: return Buffer.concat(chunks).toString("utf8").trim(); L542: } ... L661: let codeLineNo = 1; L662: const columns = clampColumns(process.stdout.columns || 100); L663: const contentWidth = Math.max(20, columns - (ASSISTANT_PREFIX.length + 4)); ... L1067: const clearLine = () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/cli.jsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> bin/waterbrother.js -> src/cli.js L1: import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; ... L137: const BIN_PATH = path.join(PACKAGE_ROOT, "bin", "waterbrother.js"); L138: const DOCS_BASE_URL = String(process.env.WATERBROTHER_DOCS_BASE_URL || "https://waterbrother.app").trim().replace(/\/+$/, ""); L139: const TELEGRAM_BRIDGE_SERVICE = "telegram"; ... L540: } L541: return Buffer.concat(chunks).toString("utf8").trim(); L542: } ... L661: let codeLineNo = 1; L662: const columns = clampColumns(process.stdout.columns || 100); L663: const contentWidth = Math.max(20, columns - (ASSISTANT_PREFIX.length + 4)); ... L1067: const clearLine = () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/cli.jsView on unpkg · L1

src/tsnet-join.jsView file

Lines 1-21javascript

1import { execFile, spawn } from "node:child_process";

2import { createWriteStream } from "node:fs";

3import { access, chmod, mkdir, unlink, writeFile } from "node:fs/promises";

4import os from "node:os";

src/acp-proxy.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/acp-proxy.js#virtual:string-array:round1View on unpkg