@vibgrate/cli@2026.806.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@vibgrate/cli@2026.806.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ITGUM42X.jsView file

10import * as net from 'net'; L11: import { spawn } from 'child_process'; L12: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

dist/chunk-ITGUM42X.jsView on unpkg · L10

dist/chunk-IS7VTH2Q.jsView file

559cwd: options.cwd, L560: shell: true, L561: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/chunk-IS7VTH2Q.jsView on unpkg · L559

dist/chunk-AN7RCXE4.jsView file

191try { L192: const req = createRequire(path2.join(hostDir, "package.json")); L193: const mod = await import(pathToFileURL(req.resolve("fastembed")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-AN7RCXE4.jsView on unpkg · L191

dist/cli.jsView file

28import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L58: import { Command, CommanderError, O

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L28

28import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L58: import { Command, CommanderError, O

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L28

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 30-70json

30 "types": "./dist/index.d.ts",

31 "import": "./dist/index.js"

32 }

33 },

34 "files": [

35 "dist",

36 "grammars",

37 "skills",

38 "scripts/postinstall.mjs",

39 "LICENSE",

40 "NOTICE",

41 "README.md",

42 "DOCS.md"

43 ],

44 "scripts": {

45 "build": "pnpm run bundle:grammars && tsup",

46 "bundle:grammars": "node scripts/bundle-grammars.mjs",

47 "stamp:pins": "node scripts/stamp-release-pins.mjs",

48 "check:pins": "node scripts/stamp-release-pins.mjs --check",

49 "demo:svg": "node scripts/gen-demo-svg.mjs",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/cli.ts",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "test": "vitest run",

55 "bench:literal": "tsx bench/literal-search.bench.ts",

56 "bench:locate": "tsx bench/locate-quality.bench.ts",

57 "bench:semantic-ask": "tsx bench/semantic-ask.bench.ts",

58 "bench:ask": "tsx bench/ask-quality.bench.ts",

59 "bench:repos": "tsx bench/repo-harness/run.mjs",

60 "bench:lib-docs": "tsx bench/lib-docs-quality.bench.ts",

61 "bench:di": "tsx bench/di-quality.bench.ts",

62 "bench:layer-a": "pnpm run bench:locate && pnpm run bench:semantic-ask && pnpm run bench:ask && pnpm run bench:lib-docs"

63 },

64 "keywords": [

65 "code-graph",

66 "codebase-intelligence",

67 "ast",

68 "tree-sitter",

69 "mcp",

70 "ai-agents",

dist/chunk-ITGUM42X.jsView file

Lines 1-30javascript

1import { vgdSocketPath, vgdPidPath } from './chunk-RBIRXQR6.js';

2import { listHostSessions, hostSessionPoolSize, acquireHostSession, evictIdleSessions, clearHostSessionPool, dropHostSession, generateOnSession } from './chunk-3LOWJSAF.js';

3import { resolveOne } from './chunk-J7LKEB2R.js';

4import { impactOf, queryGraph } from

dist/chunk-IS7VTH2Q.jsView file

Lines 539-579javascript

539 run(command, options) {

540 const roots = writableRoots.length ? writableRoots : [options.cwd];

541 if (!roots.some((r)

dist/chunk-AN7RCXE4.jsView file

Lines 171-211javascript

171 id: modelId,

172 async embed(texts) {

173 const out = [];

174 for await (const batch of model.

dist/cli.jsView file

28import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L58: import { Command, CommanderError, O

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L28

28import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from '... L29: import { CliError, ExitCode, driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssist... L30: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L31: import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftS... ... L58: import { Command, CommanderError, O

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L28

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg