agentboot: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 827 KB of source, external domains: agentboot.dev, agentskills.io, api.anthropic.com, api.openai.com, claude.ai, cli.github.com, generativelanguage.googleapis.com, github.com, json-schema.org

Source & flagged code

5 flagged

bin/agentboot.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawnSync } from "node:child_process";

4import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/agentboot.jsView on unpkg · L2

5import { dirname, join } from "node:path";

6import { createRequire } from "node:module";

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = dirname(__filename);

10const cli = join(__dirname, "..", "scripts", "cli.ts");

12// Resolve tsx from this package's own node_modules, not the user's cwd.

13// When installed globally (npm -g, brew), Node resolves bare specifiers

14// from cwd which fails. Using createRequire anchors resolution to this file.

15const require = createRequire(import.meta.url);

16const tsxPkgDir = dirname(require.resolve("tsx/package.json"));

17const tsxEntry = join(tsxPkgDir, "dist", "esm", "index.mjs");

19const result = spawnSync(

20 process.execPath,

21 ["--import", `file://${tsxEntry}`, cli, ...process.argv.slice(2)],

22 { stdio: "inherit", env: { ...process.env } }

scripts/lib/install.tsView file

Lines 304-344typescript

304/**

305 * Prompt for a directory path with live directory completion.

306 * As the user types, matching directories are suggested.

307 */

308/** Pause until the user presses any key. */

309function pressAnyKey(message: string): Promise<void> {

scripts/lib/llm-provider.tsView file

Lines 386-428typescript

386 };

387 }

388 return classResult;

389 } catch (err) {

390 console.log(chalk.red(` OpenAI API error: ${err instanceof Error ?

scripts/gen-stats.tsView file

Lines 1-24typescript

1/**

2 * gen-stats.ts

3 *

4 * Generates website/src/generated/stats.json from live project data.

5 * Run before building the website: `npx tsx scripts/gen-stats.ts`

6 *

7 * Collects:

8 * - testsPasssing — from vitest --reporter=json

9 * - tsErrors — from tsc --noEmit (0 = clean)

10 * - corePersonas — directory count under core/personas/

11 * - outputPlatforms — hardcoded (reflects compile.ts platform list)

Source & flagged code

5 flagged · loading source

bin/agentboot.jsView file

agentboot: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

bin/agentboot.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawnSync } from "node:child_process";

4import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/agentboot.jsView on unpkg · L2

5import { dirname, join } from "node:path";

6import { createRequire } from "node:module";

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = dirname(__filename);

10const cli = join(__dirname, "..", "scripts", "cli.ts");

12// Resolve tsx from this package's own node_modules, not the user's cwd.

13// When installed globally (npm -g, brew), Node resolves bare specifiers

14// from cwd which fails. Using createRequire anchors resolution to this file.

15const require = createRequire(import.meta.url);

16const tsxPkgDir = dirname(require.resolve("tsx/package.json"));

17const tsxEntry = join(tsxPkgDir, "dist", "esm", "index.mjs");

19const result = spawnSync(

20 process.execPath,

21 ["--import", `file://${tsxEntry}`, cli, ...process.argv.slice(2)],

22 { stdio: "inherit", env: { ...process.env } }

scripts/lib/install.tsView file

Lines 304-344typescript

304/**

305 * Prompt for a directory path with live directory completion.

306 * As the user types, matching directories are suggested.

307 */

308/** Pause until the user presses any key. */

309function pressAnyKey(message: string): Promise<void> {

scripts/lib/llm-provider.tsView file

Lines 386-428typescript

386 };

387 }

388 return classResult;

389 } catch (err) {

390 console.log(chalk.red(` OpenAI API error: ${err instanceof Error ?

scripts/gen-stats.tsView file

Lines 1-24typescript

1/**

2 * gen-stats.ts

3 *

4 * Generates website/src/generated/stats.json from live project data.

5 * Run before building the website: `npx tsx scripts/gen-stats.ts`

6 *

7 * Collects:

8 * - testsPasssing — from vitest --reporter=json

9 * - tsErrors — from tsc --noEmit (0 = clean)

10 * - corePersonas — directory count under core/personas/

11 * - outputPlatforms — hardcoded (reflects compile.ts platform list)

agentboot@0.12.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code