@wrongstack/core: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@wrongstack/core: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/coordination/index.jsView file

6041* Calling the unsubs on cancel/premature-cleanup prevents listener accumulation L6042: * on CollabSession (EventEmitter) across many spawn() calls. */ L6043: activeSessions = /* @__PURE__ */ new Map();

High

Child Process

Package source references child process execution.

dist/coordination/index.jsView on unpkg · L6041

•matchType = previous_version_dangerous_delta matchedPackage = @wrongstack/core@0.286.0 matchedIdentity = npm:QHdyb25nc3RhY2svY29yZQ:0.286.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coordination/index.jsView on unpkg

dist/storage/index.jsView file

8426if (/edit|update|patch|replace|apply_patch/.test(normalized)) return "edit"; L8427: if (/bash|shell|terminal|exec|command|powershell|cmd/.test(normalized)) return "terminal"; L8428: if (/fetch|browser|browse|http|url|web/.test(normalized)) return "web";

High

Shell

Package source references shell execution.

dist/storage/index.jsView on unpkg · L8426

470if (!fs.statSync(dotGit).isFile()) return checkoutRoot; L471: const gitDirLine = fs.readFileSync(dotGit, "utf8").trim(); L472: const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine); ... L1663: // src/storage/session-checkpoint-cas.ts L1664: import { spawn } from "node:child_process"; L1665: import { createHash as createHash2, randomUUID } from "node:crypto"; ... L4968: if (typeof decrypted.apiKey === "string") snapshot.apiKey = decrypted.apiKey; L4969: if (typeof decrypted.baseUrl === "string") snapshot.baseUrl = decrypted.baseUrl; L4970: if (typeof decrypted.uiLocale === "string" && decrypted.uiLocale)

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/storage/index.jsView on unpkg · L470

dist/tools/index.jsView file

802} L803: require(id) { L804: const persona = this.get(id);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/index.jsView on unpkg · L802

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2420354 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

skills/security-scanner/SKILL.mdView file

48patternName = private_key_rsa severity = critical line = 48 matchedText = const pe.....";

Critical

Secret Pattern

RSA private key in skills/security-scanner/SKILL.md

skills/security-scanner/SKILL.mdView on unpkg · L48

101patternName = private_key_rsa severity = critical line = 101 matchedText = const pe.....";

Critical

Secret Pattern

RSA private key in skills/security-scanner/SKILL.md

skills/security-scanner/SKILL.mdView on unpkg · L101

Source & flagged code

8 flagged

dist/coordination/index.jsView file

6041* Calling the unsubs on cancel/premature-cleanup prevents listener accumulation L6042: * on CollabSession (EventEmitter) across many spawn() calls. */ L6043: activeSessions = /* @__PURE__ */ new Map();

High

Child Process

Package source references child process execution.

dist/coordination/index.jsView on unpkg · L6041

•matchType = previous_version_dangerous_delta matchedPackage = @wrongstack/core@0.286.0 matchedIdentity = npm:QHdyb25nc3RhY2svY29yZQ:0.286.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coordination/index.jsView on unpkg

dist/storage/index.jsView file

Lines 450-490javascript

450 const bytes = randomBytes(len);

451 let str = "";

452 for (let i = 0; i < len; i++) {

453 str += ENCODING[bytes[i] % ENCODING_LEN];

454 }

455 return str;

456}

457function ulid(seedTime = Date.now()) {

458 return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);

459}

460

461// src/utils/wstack-paths.ts

462import { createHash } from "node:crypto";

463import * as fs from "node:fs";

464import * as os from "node:os";

465import * as path2 from "node:path";

466function canonicalProjectRoot(absRoot) {

467 const checkoutRoot = path2.resolve(absRoot);

468 const dotGit = path2.join(checkoutRoot, ".git");

469 try {

470 if (!fs.statSync(dotGit).isFile()) return checkoutRoot;

471 const gitDirLine = fs.readFileSync(dotGit, "utf8").trim();

472 const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/storage/index.jsView on unpkg · L470

473 if (!match?.[1]) return checkoutRoot;

474 const gitDir = path2.resolve(checkoutRoot, match[1].trim());

475 const commonDirFile = path2.join(gitDir, "commondir");

476 if (!fs.statSync(commonDirFile).isFile()) return checkoutRoot;

477 const commonDir = path2.resolve(gitDir, fs.readFileSync(commonDirFile, "utf8").trim());

478 if (path2.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;

479 return path2.dirname(commonDir);

480 } catch {

481 return checkoutRoot;

482 }

483}

484function projectHash(absRoot) {

485 return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);

486}

487function projectSlug(absRoot) {

488 const identityRoot = canonicalProjectRoot(absRoot);

489 const base = slugify2(path2.basename(identityRoot));

490 const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);

Lines 8406-8446javascript

8406 searches: 0,

8407 otherCalls: 0,

8408 mailReceived: 0,

8409 mailSent: 0,

8410 linesRead: 0,

8411

dist/tools/index.jsView file

Lines 782-822javascript

782 })

783]);

784var CouncilPersonaRegistry = class _CouncilPersonaRegistry {

785 byId;

786 constructor(personas = []) {

787

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2420354 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

skills/security-scanner/SKILL.mdView file

Lines 28-68markdown

28### Do

29

30```typescript

31// ✅ SAFE — parameterized query

32db.query("SELECT * FROM users WHERE id = $1", [userId]);

33

34// ✅ SAFE — escape user input

35element.textContent = userInput;

36

37// ✅ SAFE — execFile with args array