@tui-games/tui@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@tui-games/tui@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/index.jsView file

6419// src/auth.ts L6420: import { spawn, spawnSync } from "child_process"; L6421: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6419

scripts/antigravity-hook.tsView file

130/** L131: * The `agy` process behind this hook. Hooks run through `sh -c`, so the harness L132: * is a grandparent rather than the parent; walk up until a command name looks

High

Shell

Package source references shell execution.

scripts/antigravity-hook.tsView on unpkg · L130

scripts/preview-overlay.tsView file

7* bun run preview:overlay -- --game=connect4 L8: * → http://127.0.0.1:4173/?game=connect4 L9: */ L10: L11: import { spawn } from "node:child_process"; L12: import { existsSync } from "node:fs"; ... L17: const PREVIEW_HTML = join(ROOT, "overlay", "preview.html"); L18: const HOST = process.env.GAMEPIGEON_PREVIEW_HOST ?? "127.0.0.1"; L19: const DEFAULT_PORT = Number(process.env.GAMEPIGEON_PREVIEW_PORT ?? 4173);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/preview-overlay.tsView on unpkg · L7

scripts/run-with-bun.cjsView file

2const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_BUN[0] || Number(match[1]) === MIN_BUN[0] && Number(match[2]) >= MIN_BUN[1]));

Critical

Download Execute

Source downloads or fetches remote code and executes it.

scripts/run-with-bun.cjsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> scripts/gamepigeon.cjs -> scripts/run-with-bun.cjs L2: const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_B

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/run-with-bun.cjsView on unpkg · L2

scripts/manage-hermes-hooks.pyView file

•path = scripts/manage-hermes-hooks.py kind = build_helper sizeBytes = 1391 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/manage-hermes-hooks.pyView on unpkg

Source & flagged code

7 flagged

dist/index.jsView file

Lines 6399-6439javascript

6399 return "posthog-node";

6400 }

6401 initializeContext() {

6402 return new PostHogContext;

6403 }

6404 createErrorPropertiesBuilder() {

6405 return new exports_error_tracking.ErrorPropertiesBuilder([

6406 new exports_error_tracking.EventCoercer,

6407 new exports_error_tracking.ErrorCoercer,

6408 new exports_error_tracking.ObjectCoercer,

6409 new exports_error_tracking.StringCoercer,

6410 new exports_error_tracking.PrimitiveCoercer

6411 ], exports_error_tracking.createStackParser("node:javascript", exports_error_tracking.nodeStackLineParser), [

6412 createModulerModifier(),

6413 addSourceContext,

6414 createRelativePathModifier()

6415 ]);

6416 }

6417}

6418

6419// src/auth.ts

6420import { spawn, spawnSync } from "child_process";

6421import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6419

6422import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";

6423import { homedir as homedir2 } from "os";

6424import { join as join2 } from "path";

6425

6426// src/auth-pages.ts

6427var STYLE = `

6428:root{color-scheme:light}

6429*{box-sizing:border-box}

6430body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;

6431background:radial-gradient(900px 500px at 50% -20%,#fff 0%,#eef2f8 60%,#e3eaf4 100%);color:#0f172a;

6432font:15px/1.6 system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",sans-serif;-webkit-font-smoothing:antialiased}

6433.card{position:relative;overflow:hidden;width:min(100%,420px);padding:34px 28px 30px;text-align:center;

6434background:#fff;border:1px solid #e2e8f0;border-radius:16px;

6435box-shadow:0 20px 50px rgba(15,23,42,.12),0 8px 20px rgba(15,23,42,.06)}

6436.card::before{content:"";position:absolute;top:0;left:0;right:0;height:4px;

6437background:linear-gradient(90deg,#2955c9 0%,#3772ff 38%,#3bb273 72%,#e6a830 100%)}

6438.badge{display:flex;align-items:center;justify-content:center;width:44px;height:44px;margin:0 auto 16px;border-radius:999px}

6439.badge svg{width:22px;height:22px}

scripts/antigravity-hook.tsView file

Lines 110-150typescript

110export function writeSessionState(path: string, state: AntigravitySessionState): void {

111 try {

112 mkdirSync

scripts/preview-overlay.tsView file

Lines 1-27typescript

1#!/usr/bin/env bun

2/**

3 * Serve a browser preview of the Tui overlay at production frame sizes.

4 * Rebuilds the web bundle, then hosts overlay/dist + overlay/preview.html.

5 *

6 * bun run preview:overlay

7 * bun run preview:overlay -- --game=connect4

8 * → http://127.0.0.1:4173/?game=connect4

9 */

10

11import { spawn }

scripts/run-with-bun.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs");

3const { spawnSync } = require

scripts/manage-hermes-hooks.pyView file

•path = scripts/manage-hermes-hooks.py kind = build_helper sizeBytes = 1391 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/manage-hermes-hooks.pyView on unpkg