@twofive/snail-pi-web@0.9.15: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@twofive/snail-pi-web@0.9.15: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi-subagents-stale-ctx.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/pi-web.jsView file

4// eslint-disable-next-line @typescript-eslint/no-require-imports L5: const { spawn } = require("child_process"); L6: // eslint-disable-next-line @typescript-eslint/no-require-imports

High

Child Process

Package source references child process execution.

bin/pi-web.jsView on unpkg · L4

4// eslint-disable-next-line @typescript-eslint/no-require-imports L5: const { spawn } = require("child_process"); L6: // eslint-disable-next-line @typescript-eslint/no-require-imports

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pi-web.jsView on unpkg · L4

scripts/run-automation-smokes.tsView file

34stdio: "inherit", L35: shell: true, L36: env: process.env,

High

Shell

Package source references shell execution.

scripts/run-automation-smokes.tsView on unpkg · L34

lib/automation-extension-runtime.tsView file

17entry: string; L18: files: Record<string, string>; // relPath -> base64 L19: }; ... L62: } L63: return path.join(process.cwd(), "lib", "automation-extension-runtime.js"); L64: } ... L140: path.posix.join(rel, "index.ts"), L141: path.posix.join(rel, "package.json"), L142: ].filter((x): x is string => Boolean(x)); ... L429: getCommands: () => [], L430: exec: async () => ({ code: 0, stdout: "", stderr: "" }), L431: };

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/automation-extension-runtime.tsView on unpkg · L17

lib/automation-worker-runtime.cjsView file

56} L57: return import_path2.default.join(process.cwd(), "lib", "automation-extension-runtime.js"); L58: } ... L73: try { L74: bundle = JSON.parse(bundleBytes.toString("utf8")); L75: } catch (error) { ... L117: import_path2.default.posix.join(rel, "index.ts"), L118: import_path2.default.posix.join(rel, "package.json") L119: ].filter((x) => Boolean(x)); ... L335: getCommands: () => [], L336: exec: async () => ({ code: 0, stdout: "", stderr: "" }) L337: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/automation-worker-runtime.cjsView on unpkg · L56

scripts/e2e-automation-run-now.mjsView file

6Cross-file remote execution chain: scripts/e2e-automation-run-now.mjs spawns lib/automation-worker-runtime.cjs; helper contains network access plus dynamic code execution. L6: */ L7: import { spawn } from "child_process"; L8: import { setTimeout as sleep } from "timers/promises"; ... L23: // Same-origin checks compare Origin/Referer host to req.url.host — use localhost. L24: const base = `http://localhost:${port}`; L25: const bindHost = "127.0.0.1"; ... L60: const env = { L61: ...process.env, L62: PI_CODING_AGENT_DIR: agentDir, L63: PORT: String(port), L64: AUTOMATION_WORKER_HOST_PATH: join(process.cwd(), "lib", "automation-worker-runtime.cjs"), L65: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/e2e-automation-run-now.mjsView on unpkg · L6

scripts/run-automation-smokes.cjsView file

27console.log(`\n=== ${script} ===`); L28: const result = spawnSync("npx", ["--yes", "tsx@4.23.1", full], { L29: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/run-automation-smokes.cjsView on unpkg · L27

scripts/start-pi-web-proxy.ps1View file

•path = scripts/start-pi-web-proxy.ps1 kind = build_helper sizeBytes = 5428 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-pi-web-proxy.ps1View on unpkg

.next/server/app/favicon.ico.bodyView file

•path = .next/server/app/favicon.ico.body kind = high_entropy_blob sizeBytes = 22542 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/favicon.ico.bodyView on unpkg

•path = .next/server/app/favicon.ico.body kind = payload_in_excluded_dir sizeBytes = 22542 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/favicon.ico.bodyView on unpkg

lib/chatgpt-usage-refresh-scheduler.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/chatgpt-usage-refresh-scheduler.tsView on unpkg

lib/git-executor.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twofive/snail-pi-web@0.9.14 matchedIdentity = npm:QHR3b2ZpdmUvc25haWwtcGktd2Vi:0.9.14 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/git-executor.tsView on unpkg