@xyne/xyne-cli@0.3.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@xyne/xyne-cli@0.3.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist-lib/src/agent/bridge.jsView file

7Manifest entrypoint (manifest.exports) carries capability families absent from dist/build output: execution+network L7: import { getAgentDir, ProjectTrustStore } from "@earendil-works/pi-coding-agent"; L8: import { execFile } from "node:child_process"; L9: import { existsSync } from "node:fs"; ... L499: async shareSession() { L500: // No `gh auth status` preflight: its aggregate exit code is unreliable L501: // across gh versions — a single stale/invalid account (even a non-active ... L509: const { stdout } = await execFileAsync("gh", ["gist", "create", "--public=false", tmpFile]); L510: // gh prints the gist URL (https://gist.github.com/<user>/<id>) on the last line. L511: const gistUrl = stdout.trim().split("\n").pop()?.trim(); ... L535: async getTrustOptions() { L536: const cwd = runtim

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-lib/src/agent/bridge.jsView on unpkg · L7

dist/src/index.jsView file

•path = dist/src/index.js kind = oversized_source_file sizeBytes = 10949788 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/index.jsView on unpkg

•path = dist/src/index.js kind = oversized_cli_entrypoint sizeBytes = 10949788 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/src/index.jsView on unpkg

package.jsonView file

•dependencies registry_only=@opentui/core-darwin-arm64,@opentui/core-darwin-x64,@opentui/core-linux-arm64,@opentui/core-linux-x64,@opentui/core-win32-x64

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

dist-lib/src/agent/runtime/embedded-pi-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xyne/xyne-cli@0.3.0 matchedIdentity = npm:QHh5bmUveHluZS1jbGk:0.3.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-lib/src/agent/runtime/embedded-pi-runtime.jsView on unpkg

Source & flagged code

6 flagged

dist-lib/src/agent/bridge.jsView file

Lines 1-27javascript

1/**

2 * Bridge connecting an AgentSession to a XyneUI implementation.

3 *

4 * connectUI() wires up event dispatch and input actions, returning

5 * a disconnect handle for cleanup.

6 */

7import { getAgentDir, ProjectTrustStore } from "@earendil-works/pi-coding-agent";

8import { execFile } from "node:child_process";

9import { existsSync } from "node:fs";

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-lib/src/agent/bridge.jsView on unpkg · L7

10import { copyFile, mkdir, unlink } from "node:fs/promises";

11import { tmpdir } from "node:os";

12import { dirname, join, resolve } from "node:path";

13import { promisify } from "node:util";

14import { getProjectTrustOptions, getShareViewerUrl, resolveUserPath, } from "./pi-command-support.js";

15import { CHANGELOG_MARKDOWN } from "./changelog-data.js";

16import { refreshModelsFromInfoEndpoint } from "./provider/model-refresh.js";

17import { getProjectSessionsDir, getSessionsDir } from "./config.js";

18import { deleteXyneSession, listXyneSessions, loadXyneSession, renameXyneSession, } from "./session-service.js";

19import { materializeSessionFileIfNeeded } from "./session-persistence.js";

20const execFileAsync = promisify(execFile);

21/**

22 * Resolve /import's path argument. Absolute and ~ paths are used as-is;

23 * bare/relative names refer to session files, so they are searched in the

24 * xyne sessions store first (~/.xyne/agent/sessions/<project>, then the root

25 * sessions dir), and only then relative to the session cwd.

26 */

27function resolveImportPath(inputPath, cwd) {

dist/src/index.jsView file

•path = dist/src/index.js kind = oversized_source_file sizeBytes = 10949788 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src/index.jsView on unpkg

•path = dist/src/index.js kind = oversized_cli_entrypoint sizeBytes = 10949788 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/src/index.jsView on unpkg

package.jsonView file

Lines 52-92json

52 "default": "./dist-lib/packages/protocol/src/index.js"

53 },

54 "./agent/runtime/types": {

55 "types": "./dist-lib/src/agent/runtime/types.d.ts",

56 "import": "./dist-lib/src/agent/runtime/types.js",

57 "default"

dist-lib/src/agent/runtime/embedded-pi-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xyne/xyne-cli@0.3.0 matchedIdentity = npm:QHh5bmUveHluZS1jbGk:0.3.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-lib/src/agent/runtime/embedded-pi-runtime.jsView on unpkg