alink-cli@0.7.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

alink-cli@0.7.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/agentlink.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; ... L7: import { fileURLToPath } from "node:url"; L8: import WebSocket from "ws"; L9: L10: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L11: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/agentlink.jsView on unpkg · L1

1Cross-file remote execution chain: bin/agentlink.js spawns dist/bin.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; ... L7: import { fileURLToPath } from "node:url"; L8: import WebSocket from "ws"; L9: L10: const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com"; L11: const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink"); L12: const CREDENTIAL_FILE = join(STATE_DIR, "credential"); ... L37: } L38: const saved = JSON.parse(raw); L39: return saved.hub === normalizeHub(hub) && typeof saved.credential === "string"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

93async function printQr(text) { L94: const { renderQr } = await import(new URL("../dist/qr.js", import.meta.url)); L95: renderQr(text);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentlink.jsView on unpkg · L93

dist/bin.mjsView file

15955const POSIX_PATH_DELIMITER = ":"; L15956: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L15957: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L15955

8import { fileURLToPath } from "node:url"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L39: import * as NodeCrypto from "node:crypto"; L40: import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto"; L41: import * as Encoding from "effect/Encoding"; ... L57: import * as NodePath from "node:path"; L58: import * as NodeChildProcess from "node:child_process"; L59: import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpMiddleware, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespond... ... L236: //#endregion L237: //#region package.json L238: var version = "0.0.31";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L8

57import * as NodePath from "node:path"; L58: import * as NodeChildProcess from "node:child_process"; L59: import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpMiddleware, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespond... ... L2357: const RelayManagedEndpoint = Schema$1.Struct({ L2358: httpBaseUrl: TrimmedNonEmptyString, L2359: wsBaseUrl: TrimmedNonEmptyString, ... L33527: - Use attached images as primary context for UI issues. L33528: - When a URL or attachment is the only source of the subject, use available tools to inspect it. If it cannot be resolved, remain accurate rather than guessing.`; L33529: function regenerateThreadTitlePrompt(previousTitle) {

Source & flagged code

8 flagged

bin/agentlink.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/agentlink.jsView on unpkg · L1

4import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

5import { hostname, homedir } from "node:os";

6import { join } from "node:path";

7import { fileURLToPath } from "node:url";

8import WebSocket from "ws";

9

10const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com";

11const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/agentlink.jsView on unpkg · L1

12const CREDENTIAL_FILE = join(STATE_DIR, "credential");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/agentlink.jsView on unpkg · L1

13const args = process.argv.slice(2);

14

15function value(name) {

16 const index = args.findIndex((arg) => arg === `--${name}` || arg.startsWith(`--${name}=`));

17 if (index < 0) return undefined;

18 return args[index].includes("=") ? args[index].slice(name.length + 3) : args[index + 1];

19}

20

21function normalizeHub(hub) {

Lines 73-113javascript

73 if (!response.ok) throw new Error(`Hub 配置读取失败 (${response.status})。`);

74 return (await response.json()).mode;

75}

76

77async

dist/bin.mjsView file

15955const POSIX_PATH_DELIMITER = ":"; L15956: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L15957: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L15955

8import { fileURLToPath } from "node:url"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L39: import * as NodeCrypto from "node:crypto"; L40: import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto"; L41: import * as Encoding from "effect/Encoding"; ... L57: import * as NodePath from "node:path"; L58: import * as NodeChildProcess from "node:child_process"; L59: import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpMiddleware, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespond... ... L236: //#endregion L237: //#region package.json L238: var version = "0.0.31";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L8

57import * as NodePath from "node:path"; L58: import * as NodeChildProcess from "node:child_process"; L59: import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpMiddleware, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespond... ... L2357: const RelayManagedEndpoint = Schema$1.Struct({ L2358: httpBaseUrl: TrimmedNonEmptyString, L2359: wsBaseUrl: TrimmedNonEmptyString, ... L33527: - Use attached images as primary context for UI issues. L33528: - When a URL or attachment is the only source of the subject, use available tools to inspect it. If it cannot be resolved, remain accurate rather than guessing.`; L33529: function regenerateThreadTitlePrompt(previousTitle) {