@usesocial/cli@0.12.2: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@usesocial/cli@0.12.2: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @usesocial/cli@0.12.0 matchedIdentity = npm:QHVzZXNvY2lhbC9jbGk:0.12.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

15import { AsyncLocalStorage } from "node:async_hooks"; L16: import process$1, { stdin, stdout } from "node:process"; L17: import { ReadStream } from "node:tty"; L18: import { spawn, spawnSync } from "node:child_process"; L19: //#region \0rolldown/runtime.js ... L408: const sk[redacted] = `npx skills add ${org}/skill`; L409: const publicWebURL = "https://usesocial.dev"; L410: const publicAPIURL = "https://api.usesocial.dev/v1"; ... L699: try { L700: JSON.parse(value); L701: } catch { ... L974: const error = adapter.bodyValidationError?.({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L15

2863try { L2864: new Function(""); L2865: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L2863

15import { AsyncLocalStorage } from "node:async_hooks"; L16: import process$1, { stdin, stdout } from "node:process"; L17: import { ReadStream } from "node:tty"; L18: import { spawn, spawnSync } from "node:child_process"; L19: //#region \0rolldown/runtime.js ... L408: const sk[redacted] = `npx skills add ${org}/skill`; L409: const publicWebURL = "https://usesocial.dev"; L410: const publicAPIURL = "https://api.usesocial.dev/v1"; ... L699: try { L700: JSON.parse(value); L701: } catch { ... L974: const error = adapter.bodyValidationError?.({

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L15

bin/social.mjsView file

7L8: import(entryURL) L9: .then(({ main }) => main())

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/social.mjsView on unpkg · L7

Source & flagged code

5 flagged

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @usesocial/cli@0.12.0 matchedIdentity = npm:QHVzZXNvY2lhbC9jbGk:0.12.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.mjsView on unpkg

15import { AsyncLocalStorage } from "node:async_hooks"; L16: import process$1, { stdin, stdout } from "node:process"; L17: import { ReadStream } from "node:tty"; L18: import { spawn, spawnSync } from "node:child_process"; L19: //#region \0rolldown/runtime.js ... L408: const sk[redacted] = `npx skills add ${org}/skill`; L409: const publicWebURL = "https://usesocial.dev"; L410: const publicAPIURL = "https://api.usesocial.dev/v1"; ... L699: try { L700: JSON.parse(value); L701: } catch { ... L974: const error = adapter.bodyValidationError?.({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L15

2863try { L2864: new Function(""); L2865: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L2863

15import { AsyncLocalStorage } from "node:async_hooks"; L16: import process$1, { stdin, stdout } from "node:process"; L17: import { ReadStream } from "node:tty"; L18: import { spawn, spawnSync } from "node:child_process"; L19: //#region \0rolldown/runtime.js ... L408: const sk[redacted] = `npx skills add ${org}/skill`; L409: const publicWebURL = "https://usesocial.dev"; L410: const publicAPIURL = "https://api.usesocial.dev/v1"; ... L699: try { L700: JSON.parse(value); L701: } catch { ... L974: const error = adapter.bodyValidationError?.({

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L15

bin/social.mjsView file

Lines 1-14javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path"

3import { fileURLToPath, pathToFileURL } from "node:url"

4

5const packageRoot = dirname(dirname(fileURLToPath(