aws-runtime-bridge@1.9.74: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

aws-runtime-bridge@1.9.74: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-bin-executable.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

223if (process.platform === "win32") { L224: const { execSync } = await import("node:child_process"); L225: execSync(`taskkill /PID ${orphan.process.pid} /T /F`, {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L223

•matchType = previous_version_dangerous_delta matchedPackage = aws-runtime-bridge@1.9.70 matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.70 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/utils/file-utils.jsView file

132} L133: export function escapePowerShellLiteral(text) { L134: return String(text || '').replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/utils/file-utils.jsView on unpkg · L132

dist/utils/sdk-package-loader.jsView file

69const entryPath = await resolveBridgePackageEntryPath(packageName); L70: return (await import(pathToFileURL(entryPath).href)); L71: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/sdk-package-loader.jsView on unpkg · L69

dist/routes/instance.jsView file

1import { Router } from "express"; L2: import axios from "axios"; L3: import { spawn } from "node:child_process"; L4: import { createHash, timingSafeEqual } from "node:crypto"; ... L24: function resolveNpmExecutable() { L25: return process.platform === "win32" ? "npm.cmd" : "npm"; L26: } ... L38: }); L39: let stdout = ""; L40: let stderr = ""; L41: child.stdout.on("data", (chunk) => { L42: stdout += chunk.toString("utf8");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/routes/instance.jsView on unpkg · L1

dist/services/cli-commands.jsView file

1import { spawnSync } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs"; ... L12: export function readPackageVersion(packageRoot = getDefaultPackageRoot()) { L13: const packageJsonPath = path.join(packageRoot, "package.json"); L14: const metadata = JSON.parse(readFileSync(packageJsonPath, "utf-8")); L15: return metadata.version || "unknown"; ... L18: const result = spawnSync(command, args, { L19: shell: process.platform === "win32", L20: stdio: "inherit", ... L23: } L24: function defaultStdout(message) { L25: process.stdout.write(`${message}\n`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/cli-commands.jsView on unpkg · L1

dist/adapter/OpencodeSdkAdapter.jsView file

141console.log(`[OpencodeSdkAdapter] ★★★ 启动命令 ★★★ command="${openCodeCommand}"`); L142: // ★ 关键：Windows 上 .cmd 必须使用 shell: true L143: const useShell = openCodeCommand.endsWith('.cmd') || ... L146: console.log(`[OpencodeSdkAdapter] shell=${useShell}`); L147: const env = { ...process.env, ...config.envOverrides }; L148: // ★ 通过 OPENCODE_CONFIG_CONTENT 注入运行时配置（OpenCode 标准 inline config，优先级 6） L149: // 参考：https://opencode.ai/docs/config/ — "Inline config (OPENCODE_CONFIG_CONTENT env var) - runtime overrides" L150: const inlineConfig = {};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/adapter/OpencodeSdkAdapter.jsView on unpkg · L141

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView file

•path = [redacted]-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 18-58json

18 "package/acode/dist",

19 "package/acode/package.json",

20 "package/acode/README.md",

21 "package/cc-switch-sdk/dist",

22 "package/cc-switch-sdk/package.json",

23 "package/cc-switch-sdk/README.md"

24 ],

25 "bundleDependencies": [

26 "@cc-switch/sdk"

27 ],

28 "engines": {

29 "node": ">=20.0.0 <25"

30 },

31 "scripts": {

32 "build:agent-mcp": "npm run build --prefix package/aws-client-agent-mcp",

33 "build:acode": "npm run build --prefix package/acode",

34 "build:sdk": "npm run build --prefix package/cc-switch-sdk",

35 "build:all": "npm run build:sdk && npm run build:acode && npm run build:agent-mcp",

36 "prebuild": "npm run build:all",

37 "build": "tsc -p tsconfig.json",

38 "postinstall": "node scripts/ensure-bin-executable.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "pretypecheck": "npm run build:all",

40 "typecheck": "tsc -p tsconfig.json --noEmit",

41 "prestart": "npm run build:sdk && npm run build:agent-mcp && npm run build:acode",

42 "start": "node dist/index.js",

43 "predev": "npm run build:all",

44 "dev": "tsc -p tsconfig.json && node scripts/dev-runner.mjs",

45 "prepublishOnly": "npm run build",

46 "prepack": "node scripts/prepack-guard.mjs",

47 "postpack": "node scripts/postpack-restore.mjs",

48 "lint": "eslint src --max-warnings 0",

49 "lint:fix": "eslint src --fix",

50 "format": "prettier --write \"src/**/*.ts\"",

51 "format:check": "prettier --check \"src/**/*.ts\"",

52 "test": "vitest run",

53 "test:watch": "vitest",

54 "test:coverage": "vitest run --coverage"

55 },

56 "dependencies": {

57 "@agentswork/acode": "file:package/acode",

58 "@cc-switch/sdk": "file:package/cc-switch-sdk",

dist/index.jsView file

Lines 203-243javascript

203 return;

204 }

205 logger.info(`[runtime-bridge] ★ 已显式启用启动清理，检测 ${persistedSessions.length} 个持久化会话的孤儿进程...`);

206 const orphans = await detectOrphanProcesses(persistedSessions.

dist/utils/file-utils.jsView file

Lines 112-152javascript

112 };

113}

114export async function runCommand(command, args) {

115 await new Promise((resolve, reject

dist/utils/sdk-package-loader.jsView file

Lines 49-79javascript

49/**

50 * 主干流程：从 bridge 自身安装根下的 node_modules 读取包元数据，

51 * 按 package.json 的 exports/module/main 定位真实 ESM 入口，避免猜测根目录 index.js。

52 */

53export async function resolveBridgePackageEntryPath(packageName, packageRoot = BRIDGE_PACKAGE_ROOT) {

dist/routes/instance.jsView file

Lines 1-21javascript

1import { Router } from "express";

2import axios from "axios";

3import { spawn } from "node:child_process";

4import { createHash, timingSafeEqual } from "node:crypto";

dist/services/cli-commands.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";

3import path from "node:path";

4import { fileURLToPath } from "node:url"

dist/adapter/OpencodeSdkAdapter.jsView file

Lines 121-161javascript

121 totalUsage: { inputTokens: 0, outputTokens: 0 },

122 },

123 config,

124 sseActive: false,

125 pendingPermissions:

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView file

•path = [redacted]-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

package/acode/dist/grammars/grammars/tree-sitter-go.wasmView on unpkg