@vibgrate/cli@2026.819.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@vibgrate/cli@2026.819.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-EZ7UC5Y5.jsView file

3import * as path from 'path'; L4: import { execFileSync } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

dist/chunk-EZ7UC5Y5.jsView on unpkg · L3

dist/chunk-IS7VTH2Q.jsView file

559cwd: options.cwd, L560: shell: true, L561: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/chunk-IS7VTH2Q.jsView on unpkg · L559

dist/fastembed-S6YEJYQV.jsView file

19try { L20: const req = createRequire(path.join(hostDir, "package.json")); L21: return await import(pathToFileURL(req.resolve(spec)).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fastembed-S6YEJYQV.jsView on unpkg · L19

dist/cli.jsView file

31import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, ... L32: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L33: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L39: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L40: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L41: import { attachVgd } from './chunk-UEXDSWKN.js'; .

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L31

31Trigger-reachable chain: manifest.bin -> dist/cli.js L31: import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, ... L32: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L33: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L39: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L40: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

dist/chunk-XAS45W3G.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-XAS45W3G.js: citation: { title: "OWASP Top 10 2021 A01: Broken Access Control", url: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A07: Identification & Authentication Failures", url: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A02: Cryptographic Failures", url: "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A03: Injection", url: "https://owasp.org/Top10/A03_2021-Injection/" }, kind: "should_follow"

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-XAS45W3G.jsView on unpkg

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-5UG4UHKU.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibgrate/cli@2026.819.1 matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.819.1 similarity = 0.913 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-5UG4UHKU.jsView on unpkg