@wolfx/oh-my-openagent: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

6 flagged

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView file

Lines 36-76javascript

37function isMissingTopLevelModule(error, moduleName) {

38 return (

39 error instanceof Error &&

40 error.code === 'MODULE_NOT_FOUND' &&

41 typeof error.message === 'string' &&

42 error.message.includes(`Cannot find module '${moduleName}'`)

43 );

44}

46function requireOptionalModule(moduleName) {

47 let resolvedModule;

48 try {

49 resolvedModule = require.resolve(moduleName);

50 } catch (e) {

51 if (isMissingTopLevelModule(e, moduleName)) {

52 warnBestEffort(`optional module ${moduleName}`, e);

53 return null;

54 }

55 throw e;

56 }

57 return require(resolvedModule);

58}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView on unpkg · L56

60async function main() {

61 const args = await readStdinJson();

62 const url = args.url;

63 if (!url) {

64 process.stderr.write('missing url\n');

65 process.exitCode = 2;

66 return;

67 }

69 const profileDir = args.profileDir || '/tmp/.insane_pw_mobile_profile';

70 const deviceName = args.device || 'iPhone 13 Pro';

71 const waitSelector = args.waitSelector || null;

72 const timeoutMs = args.timeout || 60000;

73 const headless = args.headless ?? false;

75 let chromium, devices;

76 const playwrightExtra = requireOptionalModule('playwright-extra');

dist/tui.jsView file

186var init_js_yaml = __esm(() => { L187: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L188: __create2 = Object.create; ... L616: for (;index < max; index++) { L617: if (!isHexCode(data.charCodeAt(index))) L618: return false; ... L3905: const osProvider = options.osProvider ?? os; L3906: const env = options.env ?? process.env; L3907: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L3908: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4189: // [redacted].ts L4190: import { execFile } from "child_process";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L186

dist/skills/ast-grep/install.shView file

•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg

dist/skills/ast-grep/tests/smoke.ps1View file

•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5254849 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

packages/lsp-tools-mcp/dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wolfx/oh-my-openagent@4.15.0 matchedIdentity = npm:QHdvbGZ4L29oLW15LW9wZW5hZ2VudA:4.15.0 similarity = 0.456 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/lsp-tools-mcp/dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView file

56} L57: return require(resolvedModule); L58: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView on unpkg · L56

dist/tui.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L186

@wolfx/oh-my-openagent: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView file

Lines 36-76javascript

37function isMissingTopLevelModule(error, moduleName) {

38 return (

39 error instanceof Error &&

40 error.code === 'MODULE_NOT_FOUND' &&

41 typeof error.message === 'string' &&

42 error.message.includes(`Cannot find module '${moduleName}'`)

43 );

44}

46function requireOptionalModule(moduleName) {

47 let resolvedModule;

48 try {

49 resolvedModule = require.resolve(moduleName);

50 } catch (e) {

51 if (isMissingTopLevelModule(e, moduleName)) {

52 warnBestEffort(`optional module ${moduleName}`, e);

53 return null;

54 }

55 throw e;

56 }

57 return require(resolvedModule);

58}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView on unpkg · L56

60async function main() {

61 const args = await readStdinJson();

62 const url = args.url;

63 if (!url) {

64 process.stderr.write('missing url\n');

65 process.exitCode = 2;

66 return;

67 }

69 const profileDir = args.profileDir || '/tmp/.insane_pw_mobile_profile';

70 const deviceName = args.device || 'iPhone 13 Pro';

71 const waitSelector = args.waitSelector || null;

72 const timeoutMs = args.timeout || 60000;

73 const headless = args.headless ?? false;

75 let chromium, devices;

76 const playwrightExtra = requireOptionalModule('playwright-extra');

dist/tui.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L186

dist/skills/ast-grep/install.shView file

•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg

dist/skills/ast-grep/tests/smoke.ps1View file

•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5254849 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

packages/lsp-tools-mcp/dist/cli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/lsp-tools-mcp/dist/cli.jsView on unpkg

@wolfx/oh-my-openagent@4.19.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code