@tui-games/tui@0.4.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@tui-games/tui@0.4.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/index.jsView file

6419// src/auth.ts L6420: import { spawn, spawnSync } from "child_process"; L6421: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6419

scripts/antigravity-hook.tsView file

130/** L131: * The `agy` process behind this hook. Hooks run through `sh -c`, so the harness L132: * is a grandparent rather than the parent; walk up until a command name looks

High

Shell

Package source references shell execution.

scripts/antigravity-hook.tsView on unpkg · L130

scripts/preview-overlay.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tui-games/tui@0.3.3 matchedIdentity = npm:QHR1aS1nYW1lcy90dWk:0.3.3 similarity = 0.517 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/preview-overlay.tsView on unpkg

8* bun run preview:overlay -- --scene=restaurant-arena L9: * → http://127.0.0.1:4173/?game=restaurant-arena L10: */ L11: L12: import { spawn } from "node:child_process"; L13: import { existsSync } from "node:fs"; ... L18: const PREVIEW_HTML = join(ROOT, "overlay", "preview.html"); L19: const HOST = process.env.GAMEPIGEON_PREVIEW_HOST ?? "127.0.0.1"; L20: const DEFAULT_PORT = Number(process.env.GAMEPIGEON_PREVIEW_PORT ?? 4173);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/preview-overlay.tsView on unpkg · L8

scripts/run-with-bun.cjsView file

2const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_BUN[0] || Number(match[1]) === MIN_BUN[0] && Number(match[2]) >= MIN_BUN[1]));

Critical

Download Execute

Source downloads or fetches remote code and executes it.

scripts/run-with-bun.cjsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> scripts/gamepigeon.cjs -> scripts/run-with-bun.cjs L2: const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_B

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/run-with-bun.cjsView on unpkg · L2

scripts/sync-arcade-adapters.test.shView file

•path = scripts/sync-arcade-adapters.test.sh kind = build_helper sizeBytes = 6643 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-arcade-adapters.test.shView on unpkg

overlay/dist/app.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

overlay/dist/app.jsView on unpkg