@zubriq/code@0.19.9-7: Clean npm security report (Allow)

Loading npm security reports…

@zubriq/code@0.19.9-7: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

15 flagged

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-2IIOSEOC.jsView file

Lines 158-198javascript

158 FatalSandboxError,

159 Storage,

160 createDebugLogger,

161 getErrorMessage,

162 isNodeError

163} from "./chunk-22MNNNXE.js";

164import {

165 init_esbuild_shims

166} from "./chunk-A4BMJM77.js";

167import {

168 __commonJS,

169 __name,

170 __require,

171 __toESM

172} from "./chunk-J2S4EL5Y.js";

173

174// node_modules/command-exists/lib/command-exists.js

175var require_command_exists = __commonJS({

176 "node_modules/command-exists/lib/command-exists.js"(exports, module) {

177 "use strict";

178 init_esbuild_shims();

179 var exec = __require("child_process").exec;

180 var execSync = __require("child_process").execSync;

High

Child Process

Package source references child process execution.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

181 var fs2 = __require("fs");

182 var path4 = __require("path");

183 var access2 = fs2.access;

184 var accessSync = fs2.accessSync;

185 var constants = fs2.constants || fs2;

186 var isUsingWindows = process.platform == "win32";

187 var fileNotExists = /* @__PURE__ */ __name(function(commandName, callback) {

188 access2(

189 commandName,

190 constants.F_OK,

191 function(err) {

192 callback(!err);

193 }

194 );

195 }, "fileNotExists");

196 var fileNotExistsSync = /* @__PURE__ */ __name(function(commandName) {

197 try {

198 accessSync(commandName, constants.F_OK);

dist/chunks/chunk-22IFUCVR.jsView file

Lines 91-131javascript

91 } catch (_error) {

92 console.warn(

93 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

94 _error

95 )}. Falling back to the platform browser opener.`

96 );

dist/chunks/chunk-YKZIAK7C.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-YKZIAK7C.jsView on unpkg · L279

dist/chunks/chunk-BMIVZOPF.jsView file

1828var err = new Error( L1829: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1830: ); ... L1939: } L1940: if (process.platform === "win32") { L1941: const osRelease = os3.release().split("."); ... L1986: supportsColor: getSupportLevel, L1987: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1988: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4844: function wrapAnsi(string, columns, options) { L4845: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L4846: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-BMIVZOPF.jsView on unpkg · L1828

dist/chunks/gemini-TVS4II43.jsView file

Lines 54-94javascript

54 loadSettings

55} from "./chunk-GINK3SVR.js";

56import {

57 initializeI18n,

58 resolveLanguageSetting

59} from "./chunk-3X36H5YA.js";

60import "./chunk-TLRYABYP.js";

dist/chunks/chunk-7F44OPK6.jsView file

•context = ayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs10.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs10.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs10.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs10.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Get

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

•path = dist/chunks/chunk-7F44OPK6.js kind = oversized_source_file sizeBytes = 5628803 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

dist/chunks/chunk-EMJ7Z2LT.jsView file

38Cross-file remote execution chain: dist/chunks/chunk-EMJ7Z2LT.js spawns dist/chunks/devtools-FM6GJPYG.js; helper contains network access plus dynamic code execution. L38: ]; L39: if (process.platform !== "win32") { L40: module.exports.push( ... L187: } L188: process14.exitCode = code || /* istanbul ignore next */ L189: 0; ... L563: function formatProdErrorMessage(code) { L564: var url = "https://react.dev/errors/" + code; L565: if (1 < arguments.length) { ... L1453: controller: new AbortControllerLocal(), L1454: data: /* @__PURE__ */ new Map(), L1455: refCount: 0

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-EMJ7Z2LT.jsView on unpkg · L38

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

15 flagged · loading source

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-2IIOSEOC.jsView file

178init_esbuild_shims(); L179: var exec = __require("child_process").exec; L180: var execSync = __require("child_process").execSync;

High

Child Process

Package source references child process execution.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

178init_esbuild_shims(); L179: var exec = __require("child_process").exec; L180: var execSync = __require("child_process").execSync; ... L338: }; L339: function findModelConfig(modelProviders, providerProtocol, authType, modelId, baseUrl) { L340: if (!modelProviders || !modelId) { ... L2697: const entries = JSON.parse( L2698: readFileSync(sessionsPath2, "utf-8") L2699: );

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

178init_esbuild_shims(); L179: var exec = __require("child_process").exec; L180: var execSync = __require("child_process").execSync;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

dist/chunks/chunk-22IFUCVR.jsView file

111case "win32": L112: command = "powershell.exe"; L113: args = [

High

Shell

Package source references shell execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L111

dist/chunks/chunk-YKZIAK7C.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-YKZIAK7C.jsView on unpkg · L279

dist/chunks/chunk-BMIVZOPF.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-BMIVZOPF.jsView on unpkg · L1828

dist/chunks/gemini-TVS4II43.jsView file

74import { L75: writeStderrLine L76: } from "./chunk-Y6Z2O3WR.js"; ... L179: init_esbuild_shims(); L180: import dns from "node:dns"; L181: import os4 from "node:os"; ... L768: try { L769: const parsed = JSON.parse(raw); L770: return { exists: true, canonical: canonicalize(parsed) }; ... L1113: const trimmed = rawInput.trim(); L1114: const launchCwd = process.cwd(); L1115: const probe = new GitWorktreeService(launchCwd);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/gemini-TVS4II43.jsView on unpkg · L74

dist/chunks/chunk-7F44OPK6.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

•path = dist/chunks/chunk-7F44OPK6.js kind = oversized_source_file sizeBytes = 5628803 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

dist/chunks/chunk-EMJ7Z2LT.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-EMJ7Z2LT.jsView on unpkg · L38

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

15 flagged

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-2IIOSEOC.jsView file

Lines 158-198javascript

158 FatalSandboxError,

159 Storage,

160 createDebugLogger,

161 getErrorMessage,

162 isNodeError

163} from "./chunk-22MNNNXE.js";

164import {

165 init_esbuild_shims

166} from "./chunk-A4BMJM77.js";

167import {

168 __commonJS,

169 __name,

170 __require,

171 __toESM

172} from "./chunk-J2S4EL5Y.js";

173

174// node_modules/command-exists/lib/command-exists.js

175var require_command_exists = __commonJS({

176 "node_modules/command-exists/lib/command-exists.js"(exports, module) {

177 "use strict";

178 init_esbuild_shims();

179 var exec = __require("child_process").exec;

180 var execSync = __require("child_process").execSync;

High

Child Process

Package source references child process execution.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-2IIOSEOC.jsView on unpkg · L178

181 var fs2 = __require("fs");

182 var path4 = __require("path");

183 var access2 = fs2.access;

184 var accessSync = fs2.accessSync;

185 var constants = fs2.constants || fs2;

186 var isUsingWindows = process.platform == "win32";

187 var fileNotExists = /* @__PURE__ */ __name(function(commandName, callback) {

188 access2(

189 commandName,

190 constants.F_OK,

191 function(err) {

192 callback(!err);

193 }

194 );

195 }, "fileNotExists");

196 var fileNotExistsSync = /* @__PURE__ */ __name(function(commandName) {

197 try {

198 accessSync(commandName, constants.F_OK);

dist/chunks/chunk-22IFUCVR.jsView file

Lines 91-131javascript

91 } catch (_error) {

92 console.warn(

93 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

94 _error

95 )}. Falling back to the platform browser opener.`

96 );

dist/chunks/chunk-YKZIAK7C.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-YKZIAK7C.jsView on unpkg · L279

dist/chunks/chunk-BMIVZOPF.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-BMIVZOPF.jsView on unpkg · L1828

dist/chunks/gemini-TVS4II43.jsView file

Lines 54-94javascript

54 loadSettings

55} from "./chunk-GINK3SVR.js";

56import {

57 initializeI18n,

58 resolveLanguageSetting

59} from "./chunk-3X36H5YA.js";

60import "./chunk-TLRYABYP.js";

dist/chunks/chunk-7F44OPK6.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

•path = dist/chunks/chunk-7F44OPK6.js kind = oversized_source_file sizeBytes = 5628803 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-7F44OPK6.jsView on unpkg

dist/chunks/chunk-EMJ7Z2LT.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-EMJ7Z2LT.jsView on unpkg · L38

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

@zubriq/code@0.19.9-7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code