agenthub-ai@0.26.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

agenthub-ai@0.26.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist-publish/main.jsView file

52After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary...

High

Child Process

Package source references child process execution.

dist-publish/main.jsView on unpkg · L52

52After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-publish/main.jsView on unpkg · L52

52After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-publish/main.jsView on unpkg · L52

52Trigger-reachable command-output exfiltration chain: manifest.main -> dist-publish/main.js L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-publish/main.jsView on unpkg · L52

1Trigger-reachable persistence chain: manifest.main -> dist-publish/main.js L1: #!/usr/bin/env node L2: var Kr=Object.create;var gt=Object.defineProperty;var Vr=Object.getOwnPropertyDescriptor;var Gr=Object.getOwnPropertyNames;var zr=Object.getPrototypeOf,Qr=Object.prototype.hasOwnPr... L3: ... L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary... L55: `);o>0&&c.shift();

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist-publish/main.jsView on unpkg · L1

1#!/usr/bin/env node L2: var Kr=Object.create;var gt=Object.defineProperty;var Vr=Object.getOwnPropertyDescriptor;var Gr=Object.getOwnPropertyNames;var zr=Object.getPrototypeOf,Qr=Object.prototype.hasOwnPr... L3: ... L52: After pairing, the token is persisted and subsequent starts auto-reconnect; on token invalidation L53: (app unbind/delete) the local token is cleared and the agent exits.`,pairingCode:"[AgentHubAgent] pairing code: {{code}}",pairingExpires:"[AgentHubAgent] expires at {{time}}, waiti... L54: `),d=l.slice(0,-1);this.buffers.set(e,l.at(-1)??"");let p=null,y=null,A=null,h=0;for(let m of d){let v=m.trim();if(v){h++;try{let D=JSON.parse(v),F=this.analyzeLine(D,e);F.boundary... L55: `);o>0&&c.shift();for(let l=c.length-1;l>=0;l--){let d=c[l];if(!d)continue;let p=d.match(/"cw

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-publish/main.jsView on unpkg · L1

Source & flagged code

6 flagged

dist-publish/main.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var Kr=Object.create;var gt=Object.defineProperty;var Vr=Object.getOwnPropertyDescriptor;var Gr=Object.getOwnPropertyNames;var zr=Object.getPrototypeOf,Qr=Object.prototype.hasOwnProperty;var P=(n,e,t)=>()=>{if(t)throw t[0];try{return n&&(e=n(n=0)),e}catch(s){throw t=[s],s}};var _=(n,e)=>()=>{try{return e||n((e={exports:{}}).exports,e),e.exports}catch(t){throw e=0,t}},Qt=(n,e)=>{for(var t in e)gt(n,t,{get:e[t],enumerable:!0})},Jr=(n,e,t,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Gr(e))!Qr.call(n,i)&&i!==t&&gt(n,i,{get:()=>e[i],enumerable:!(s=Vr(e,i))||s.enumerable});return ...

3

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist-publish/main.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-publish/main.jsView on unpkg · L1

4\u7528\u6CD5: pnpm dev:agent [\u547D\u4EE4] (\u751F\u4EA7: node dist/main.js [\u547D\u4EE4])

5

6\u547D\u4EE4:

7 (\u65E0) \u9ED8\u8BA4\u542F\u52A8\uFF1A\u6709 token \u91CD\u8FDE\uFF0C\u65E0 token \u7533\u8BF7\u914D\u5BF9\u7801\u7B49 App \u8F93\u5165\uFF1Bdaemon \u5DF2\u5728\u8DD1\u5219\u8FDB\u89C2\u5BDF\u8005

8 unbind \u89E3\u7ED1\u5F53\u524D\u8D26\u53F7\uFF08\u6E05\u672C\u5730 token + Server archive \u8BE5 agent\uFF09\uFF0C\u9000\u51FA

9 repair \u91CD\u65B0\u914D\u5BF9\uFF08\u5FFD\u7565\u65E7 token \u7533\u8BF7\u65B0\u7801\uFF1B\u6210\u529F\u540E\u65E7 agent \u5F52\u6863\uFF0C\u7ED1\u65B0\u8D26\u53F7\uFF09

10 install \u5B89\u88C5\u4E3A\u81EA\u542F\u670D\u52A1\uFF08Windows \u6CE8\u518C\u8868 Run / Linux systemd / macOS launchd\uFF09

11 uninstall \u5378\u8F7D\u81EA\u542F\u670D\u52A1

12 status \u67E5\u770B\u7ED1\u5B9A\u4FE1\u606F\u4E0E\u670D\u52A1\u72B6\u6001\uFF08\u4E0D\u8FDE server\uFF09

13 update \u68C0\u67E5\u5E76\u66F4\u65B0\u5230\u6700\u65B0\u7248\uFF08\u505C daemon + npm install + \u91CD\u542F\uFF1B\u52FF\u7528 npm update \u4F1A\u56E0 claude.exe \u5360\u7528\u5931\u8D25\uFF09

14 lang \u5207\u6362\u754C\u9762\u8BED\u8A00\uFF08\u4E2D\u6587/English\uFF09\uFF0C\u91CD\u542F\u540E\u751F\u6548

15 -v \u67E5\u770B\u7248\u672C\u53F7\uFF08agent + SDK\uFF09

16 help \u663E\u793A\u6B64\u5E2E\u52A9

17

18\u73AF\u5883\u53D8\u91CF:

19 AGENT_BACKEND \u667A\u80FD\u4F53\u540E\u7AEF: claude\uFF08\u9ED8\u8BA4\uFF09| \u672A\u6765\u6269\u5C55 codex \u7B49

20 SERVER \u9884\u8BBE\u670D\u52A1\u5668: local | lan | prod\uFF08\u4F18\u5148\u4E8E SERVER_URL\uFF09

21 SERVER_URL \u81EA\u5B9A\u4E49 Server \u5730\u5740\uFF08\u672A\u8BBE SERVER \u65F6\u7528\uFF1Brelease \u5185\u5D4C\u6B63\u5F0F\u670D\uFF09

Long lines were clipped for display.

Lines 32-72javascript

32 (none) Default: reconnect with stored token, or request pairing code; if daemon already running, enter observer mode

33 unbind Unbind current account (clear local token + archive server agent), exit

34 repair Re-pair (ignore old token, request new code; old agent archived on success)

35 install Install as auto-start service (Win registry Run