@z2h-academy/tutor@0.5.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@z2h-academy/tutor@0.5.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/cli/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @z2h-academy/tutor@0.5.13 matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.13 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/login.jsView on unpkg

19import { fileURLToPath } from "node:url"; L20: const __dirname = dirname(fileURLToPath(import.meta.url)); L21: const GITHUB_DEVICE_URL = "https://github.com/login/device/code"; L22: const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token"; L23: const PROVISION_URL = process.env.TUTOR_PROVISION_URL ?? L24: "https://ftpxfyctzcchkldeccnq.supabase.co/functions/v1/tutor-provision"; ... L33: headers: { "Content-Type": "application/json", Accept: "application/json" }, L34: body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }), L35: }); ... L38: } L39: const device = (await deviceResp.json()); L40: console.log("");

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli/login.jsView on unpkg · L19

90// Auto-configurar el MCP remoto del harness en OpenCode (Arq-2). // Si falla, el estudiante puede correr `tutor setup` manualmente. try { const { execSync } = await import("node:child_process"); const setupBin = join(__dirname, "setup.js"); execSync(`node "${setupBin}"`, { stdio: "inherit" });

Medium

Ai Review Evidence

The login command automatically runs setup after obtaining GitHub credentials, without a separate setup confirmation.

dist/cli/login.jsView on unpkg · L90

dist/cli/runtime.jsView file

72onMessage: async (msg) => { switch (msg.type) { case "inject_skill": await sk[redacted](msg.session_id, msg.skill); console.log(`[harness→runtime] injected skill "${msg.skill.name}" into ${msg.session_id}`); break;

Medium

Ai Review Evidence

The user-invoked runtime accepts Harness messages and forwards an inject_skill request to its skill writer.

dist/cli/runtime.jsView on unpkg · L72

dist/skills/injector.jsView file

20async injectSkill(sessionId, skill) { const dir = this.ensureSessionDir(sessionId); const skillDir = join(dir, skill.name); await mkdir(skillDir, { recursive: true }); await writeFile(join(skillDir, "SKILL.md"), skill.body, "utf-8");

Medium

Ai Review Evidence

The skill writer uses unvalidated server-supplied session and skill names to write server-supplied content beneath OpenCode's global skills directory.

dist/skills/injector.jsView on unpkg · L20

Source & flagged code

5 flagged

dist/cli/login.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * tutor login — CLI de autenticación para estudiantes.

4 *

5 * Implementa el device flow de GitHub:

6 * 1. Pide un device code a GitHub (client_id de la OAuth app de z2h-academy).

7 * 2. Muestra el código + URL de verificación al estudiante.

8 * 3. Polea hasta que el estudiante autorice (mismo UX que `gh auth login`).

9 * 4. Con el access token, llama a la Edge Function `tutor-provision`

10 * (Supabase) que valida la whitelist pre_enrollment y crea una service

11 * account de MinIO read-only.

12 * 5. Guarda las credenciales en ~/.config/z2h/tutor.env (chmod 600).

13 *

14 * Uso: node dist/cli/login.js

15 */

16import { mkdir, writeFile, chmod } from "node:fs/promises";

17import { homedir } from "node:os";

18import { dirname, join } from "node:path";

19import { fileURLToPath } from "node:url";

20const __dirname = dirname(fileURLToPath(import.meta.url));

21const GITHUB_DEVICE_URL = "https://github.com/login/device/code";

22const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";

23const PROVISION_URL = process.env.TUTOR_PROVISION_URL ??

24 "https://ftpxfyctzcchkldeccnq.supabase.co/functions/v1/tutor-provision";

25const CLIENT_ID = process.env.TUTOR_GITHUB_CLIENT_ID ?? "Ov23liYqkrsoQJo0ZMMc";

26const SCOPE = "user:email";

27const ENV_DIR = join(homedir(), ".config", "z2h");

28const ENV_FILE = join(ENV_DIR, "tutor.env");

29async function main() {

30 console.log("[tutor] iniciando login con GitHub (device flow)...");

31 const deviceResp = await fetch(GITHUB_DEVICE_URL, {

32 method: "POST",

33 headers: { "Content-Type": "application/json", Accept: "application/json" },

34 body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),

35 });

36 if (!deviceResp.ok) {

37 fail(`no se pudo obtener device code: ${deviceResp.status}`);

38 }

39 const device = (await deviceResp.json());

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli/login.jsView on unpkg · L19

Lines 70-110javascript

70 // API key fields are populated by the student later (BYOK or OpenCode Go)

71 `TUTOR_API_KEY_PROVIDER=opencode-go`,

72 ];

73 if (email) {

74 envLines.push(`TUTOR_STUDENT_EMAIL=${email}`);

75 }

76 // Alcance del estudiante (snapshot del login). El MCP lista/lee SOLO estos

77

•matchType = previous_version_dangerous_delta matchedPackage = @z2h-academy/tutor@0.5.13 matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.13 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/login.jsView on unpkg

dist/cli/runtime.jsView file

Lines 52-92javascript

52 await opencode.start();

53 // 2. Check Docker

54 const dockerAvailable = await checkDocker();

55 // 3. Connect to Harness

56 const

dist/skills/injector.jsView file

Lines 1-40javascript

1/**

2 * Skill injector: handles inject_skill messages from the Harness.

3 *

4 * For each skill, writes the content to:

5 * ~/.config/opencode/skills/SESSION_ID/SKILL_NAME/SKILL.md

6 *

7 * This scopes skills to the session — when the session ends, the runtime

8 * can clean up the directory.

9 *

10 * OpenCode picks up skills from ~/.config/opencode/skills (any subdir/SKILL.md)

11