@vibgrate/cli@2026.829.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@vibgrate/cli@2026.829.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-EZ7UC5Y5.jsView file

3import * as path from 'path'; L4: import { execFileSync } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

dist/chunk-EZ7UC5Y5.jsView on unpkg · L3

dist/interactive-VQM2CTE2.jsView file

728return (command) => { L729: const res = spawnSync(command, { cwd: root, shell: true, encoding: "utf8", timeout: 12e4, maxBuffer: 10 * 1024 * 1024 }); L730: const stdout = (res.stdout ?? "") + (res.stderr ? `

High

Shell

Package source references shell execution.

dist/interactive-VQM2CTE2.jsView on unpkg · L728

dist/fastembed-S6YEJYQV.jsView file

19try { L20: const req = createRequire(path.join(hostDir, "package.json")); L21: return await import(pathToFileURL(req.resolve(spec)).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fastembed-S6YEJYQV.jsView on unpkg · L19

dist/chunk-BODXEZEY.jsView file

20L21: var DEFAULT_REGISTRY = "https://registry.npmjs.org"; L22: function registryBase(opts) { L23: return (process.env.VIBGRATE_MODULE_REGISTRY || opts.registry || DEFAULT_REGISTRY).replace(/\/+$/, ""); L24: } L25: function modulesBaseDir() { L26: const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache"); L27: return path.join(base, "vibgrate", "modules"); ... L33: try { L34: return JSON.parse(fs.readFileSync(stateFile(), "utf8")); L35: } catch { ... L103: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-BODXEZEY.jsView on unpkg · L20

dist/cli.jsView file

32import './chunk-EGMBHPXV.js'; L33: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L34: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L41: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L42: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L43: import { attachVgd } from './chunk-KCKG3EEJ.js'; ... L74: import { Command, CommanderError, Option } from 'commander'; L75: import { execSync, spawn, spawnSync, execFileSync } from 'child_process'; L76: i

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L32

32Trigger-reachable chain: manifest.bin -> dist/cli.js L32: import './chunk-EGMBHPXV.js'; L33: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L34: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L41: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L42: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L43: import { attachVgd } from './chunk-KCKG3EEJ.js'; ... L74: import { Command, CommanderError, Option } from 'commander'; L75: import { execSync, spawn, s

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L32

dist/chunk-65YN3BG3.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-65YN3BG3.js: citation: { title: "OWASP Top 10 2021 A01: Broken Access Control", url: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A07: Identification & Authentication Failures", url: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A02: Cryptographic Failures", url: "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A03: Injection", url: "https://owasp.org/Top10/A03_2021-Injection/" }, kind: "should_follow"

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-65YN3BG3.jsView on unpkg

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-HUJZO4K5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibgrate/cli@2026.819.3 matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.819.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-HUJZO4K5.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 30-70json

30 "types": "./dist/index.d.ts",

31 "import": "./dist/index.js"

32 }

33 },

34 "files": [

35 "dist",

36 "grammars",

37 "skills",

38 "scripts/postinstall.mjs",

39 "LICENSE",

40 "NOTICE",

41 "README.md",

42 "DOCS.md"

43 ],

44 "scripts": {

45 "build": "pnpm run bundle:grammars && tsup",

46 "bundle:grammars": "node scripts/bundle-grammars.mjs",

47 "stamp:pins": "node scripts/stamp-release-pins.mjs",

48 "check:pins": "node scripts/stamp-release-pins.mjs --check",

49 "demo:svg": "node scripts/gen-demo-svg.mjs",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "dev": "tsx src/cli.ts",

52 "lint": "eslint src",

53 "typecheck": "tsc --noEmit",

54 "test": "vitest run",

55 "bench:literal": "tsx bench/literal-search.bench.ts",

56 "bench:locate": "tsx bench/locate-quality.bench.ts",

57 "bench:semantic-ask": "tsx bench/semantic-ask.bench.ts",

58 "bench:lib-docs": "tsx bench/lib-docs-quality.bench.ts",

59 "bench:di": "tsx bench/di-quality.bench.ts",

60 "bench:layer-a": "pnpm run bench:locate && pnpm run bench:semantic-ask && pnpm run bench:lib-docs"

61 },

62 "keywords": [

63 "code-graph",

64 "codebase-intelligence",

65 "ast",

66 "tree-sitter",

67 "mcp",

68 "ai-agents",

69 "drift",

70 "deterministic",

dist/chunk-EZ7UC5Y5.jsView file

Lines 1-23javascript

1import { __esm } from './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as path from 'path';

dist/interactive-VQM2CTE2.jsView file

Lines 708-738javascript

708 result.stopped === "finished" ? c.green(`\u2714 ${result.finalText}`) : result.stopped === "max-steps" ? c.yellow(`stopped at the step limit

dist/fastembed-S6YEJYQV.jsView file

Lines 1-39javascript

1import './chunk-Z6ZWNWWR.js';

2import * as fs from 'fs';

3import * as https from 'https';

4import

dist/chunk-BODXEZEY.jsView file

Lines 1-40javascript

1import { refreshIfStale } from './chunk-B5VCPIKT.js';

2import { listedToolNames, budgetSuffix, TOOLS, renderToolResult, warmEmbedderInBackground, countTokens } from './chunk-65YN3BG3.js';

3import { sanitizeClient, recordSaving, SAVINGS_TOOLS, PER_FILE_TOKENS } from './chunk-OAYSRM7J.js';

4import { attachVgd } from

dist/cli.jsView file

32import './chunk-EGMBHPXV.js'; L33: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L34: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L41: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L42: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L43: import { attachVgd } from './chunk-KCKG3EEJ.js'; ... L74: import { Command, CommanderError, Option } from 'commander'; L75: import { execSync, spawn, spawnSync, execFileSync } from 'child_process'; L76: i

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L32

32Trigger-reachable chain: manifest.bin -> dist/cli.js L32: import './chunk-EGMBHPXV.js'; L33: import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as p... L34: import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js'; ... L41: import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-57ZRSCHY.js'; L42: import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js'; L43: import { attachVgd } from './chunk-KCKG3EEJ.js'; ... L74: import { Command, CommanderError, Option } from 'commander'; L75: import { execSync, spawn, s

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L32

dist/chunk-65YN3BG3.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-65YN3BG3.js: citation: { title: "OWASP Top 10 2021 A01: Broken Access Control", url: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A07: Identification & Authentication Failures", url: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A02: Cryptographic Failures", url: "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" }, kind: "should_follow", citation: { title: "OWASP Top 10 2021 A03: Injection", url: "https://owasp.org/Top10/A03_2021-Injection/" }, kind: "should_follow"

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-65YN3BG3.jsView on unpkg

grammars/tree-sitter-go.wasmView file

•path = grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

grammars/tree-sitter-go.wasmView on unpkg

dist/chunk-HUJZO4K5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibgrate/cli@2026.819.3 matchedIdentity = npm:QHZpYmdyYXRlL2NsaQ:2026.819.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-HUJZO4K5.jsView on unpkg