@zhuxixi/pi-agent-board@0.10.1: Manual Review npm security report | LPM Firewall

Loading npm security reports…

@zhuxixi/pi-agent-board@0.10.1: Manual Review npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-vulns.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

runner/state-runner.mjsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { readJson } from "../src/core/atomic.mjs";

High

Child Process

Package source references child process execution.

runner/state-runner.mjsView on unpkg · L8

src/core/auto-state.mjsView file

25/** @param {NodeJS.ProcessEnv|Record<string,string|undefined>} [env] */ L26: export function autoStateEnabled(env = process.env) { L27: const raw = env.AGENT_BOARD_AUTO_STATE ?? env.AGENT_VIEW_AUTO_STATE; ... L300: try { L301: const parsed = JSON.parse(candidate); L302: if (parsed && typeof parsed === "object") return parsed;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/auto-state.mjsView on unpkg · L25

scripts/patch-vulns.mjsView file

46try { L47: execSync(`npm install ${name}@${version} --prefix "${tmp}" --ignore-scripts`, { L48: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/patch-vulns.mjsView on unpkg · L46

scripts/release.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/release.mjs#virtual:normalized:round1View on unpkg

src/core/pty-support.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zhuxixi/pi-agent-board@0.7.0 matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.7.0 similarity = 0.559 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pty-support.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-support.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-support.mjsView on unpkg

scripts/release_helper.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = scripts/release_helper.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release_helper.mjsView on unpkg

runner/title-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = runner/title-runner.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runner/title-runner.mjsView on unpkg

src/core/code-refs.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/code-refs.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/code-refs.mjsView on unpkg

src/core/pty-scroll.mjsView file

•matchType = normalized_sha256 matchedPackage = @zhuxixi/pi-agent-board@0.6.2 matchedPath = src/core/pty-scroll.mjs matchedIdentity = npm:QHpodXhpeGkvcGktYWdlbnQtYm9hcmQ:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/pty-scroll.mjsView on unpkg