automation-tool-manager@1.9.8: Suspicious npm security report | LPM Firewall

Loading npm security reports…

automation-tool-manager@1.9.8: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = sh ./scripts/setup.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = sh ./scripts/setup.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

36"scripts": { "test": "echo \"Error: no test specified\" && exit 1", "postinstall": "sh ./scripts/setup.sh" }

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook runs a large shell setup program automatically.

package.jsonView on unpkg · L36

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 48851 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

266for profile in "${profiles[@]}"; do [[ ! -f "$profile" ]] && touch "$profile" if ! grep -qF "export ${var_name}=" "$profile" 2>/dev/null; then { echo ""; echo "# Added by automation-setup script"; echo "export ${var_name}=\"${var_value}\""; } >> "$profile" 2>/dev/null || true fi done export "${var_name}"="${var_value}"

Medium

Ai Review Evidence

The hook downloads and configures Java and Maven, persists environment settings in shell profiles, and adds a global wrapper to PATH.

scripts/setup.shView on unpkg · L266

jdeploy-bundle/jar-runner.jarView file

•path = jdeploy-bundle/jar-runner.jar kind = compressed_blob sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/jar-runner.jarView on unpkg

•path = jdeploy-bundle/jar-runner.jar kind = nested_archive_needs_inspection sizeBytes = 1839 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/jar-runner.jarView on unpkg

jdeploy-bundle/tool-manager-1.4.3.jarView file

•path = jdeploy-bundle/tool-manager-1.4.3.jar kind = high_entropy_blob sizeBytes = 34098977 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.4.3.jarView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 16-41json

16 "generateLegacyBundles": false,

17 "javaVersion": "17",

18 "jar": "target/tool-manager-1.4.3.jar",

19 "javafx": false,

20 "title": "Automation Agent"

21 },

22 "files": [

23 "jdeploy-bundle",

24 "scripts/setup.sh",

25 "target/tool-manager-1.4.3.jar"

26 ],

27 "dependencies": {

28 "command-exists-promise": "^2.0.2",

29

30 "node-fetch": "2.6.7",

31 "shelljs": "^0.10.0",

32 "tar": "^7.5.12",

33 "vite": "8.0.5",

34 "yauzl": "3.2.1"

35 },

36 "scripts": {

37 "test": "echo \"Error: no test specified\" && exit 1",

38 "postinstall": "sh ./scripts/setup.sh"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 }

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook runs a large shell setup program automatically.

package.jsonView on unpkg · L36

40}

41

scripts/setup.shView file

Lines 246-286text

246 sed -i "s|^export ${var_name}=.*|${export_line}|" "$bashrc"

247 log_info "Updated ${var_name} in ~/.bashrc"

248 else

249 { echo ""; echo "# Added by automation-setup script"; echo "${export_line}"; } >> "$bashrc"

250 log_success "✓ Persisted ${var_name} to ~/.bashrc"

251 fi

252 export "${var_name}"="${var_value}"

253 else

254 local profiles=()

255 [[ -f "$HOME/.bashrc" ]] && profiles+=("$HOME/.bashrc")

256 [[ -f "$HOME/.zshrc" ]] && profiles+=("$HOME/.zshrc")

257 [[ -f "$HOME/.bash_profile" ]] && profiles+=("$HOME/.bash_profile")

jdeploy-bundle/jar-runner.jarView file

•path = jdeploy-bundle/jar-runner.jar kind = compressed_blob sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/jar-runner.jarView on unpkg

•path = jdeploy-bundle/jar-runner.jar kind = nested_archive_needs_inspection sizeBytes = 1839 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/jar-runner.jarView on unpkg

jdeploy-bundle/tool-manager-1.4.3.jarView file

•path = jdeploy-bundle/tool-manager-1.4.3.jar kind = high_entropy_blob sizeBytes = 34098977 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.4.3.jarView on unpkg