beecork-pipe: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

beecork-pipe: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/tasks/scheduler.jsView file

3import path from 'node:path'; L4: import { exec } from 'node:child_process'; L5: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/tasks/scheduler.jsView on unpkg · L3

8import { logger } from '../util/logger.js'; L9: export const execAsync = promisify(exec); L10: /**

High

Shell

Package source references shell execution.

dist/tasks/scheduler.jsView on unpkg · L8

dist/version.jsView file

1import { createRequire } from 'node:module'; L2: const require = createRequire(import.meta.url); L3: const pkg = require('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L1

dist/util/paths.jsView file

9export function getBeecorkHome() { L10: return process.env.BEECORK_HOME || path.join(os.homedir(), BEECORK_DIR); L11: } ... L17: } L18: export function getCrontabPath() { L19: return path.join(getBeecorkHome(), 'crontab.json');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/util/paths.jsView on unpkg · L9

dist/cli/doctor.jsView file

1import fs from 'node:fs'; L2: import { execSync } from 'node:child_process'; L3: import { getConfig } from '../config.js'; ... L11: const bin = config.claudeCode?.bin || 'claude'; L12: const whichCmd = process.platform === 'win32' ? 'where' : 'which'; L13: execSync(`${whichCmd} ${bin}`, { encoding: 'utf-8' }); ... L37: try { L38: const resp = await fetch(`https://api.telegram.org/bot${config.telegram.token}/getMe`, { L39: signal: AbortSignal.timeout(10000), ... L41: if (resp.ok) { L42: const data = (await resp.json()); L43: checks.push({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/doctor.jsView on unpkg · L1

dist/cli/commands.jsView file

245try { L246: execSync('npm install -g beecork-pipe@latest', { stdio: 'inherit', timeout: 300000 }); L247: const newVersion = execSync('npm view beecork-pipe version', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands.jsView on unpkg · L245

Source & flagged code

8 flagged

package.jsonView file

Lines 2-42json

2 "name": "beecork-pipe",

3 "version": "1.8.0",

4 "description": "Claude Code always-on infrastructure — a phone number, a memory, and an alarm clock",

5 "type": "module",

6 "bin": {

7 "beecork-pipe": "dist/index.js"

8 },

9 "engines": {

10 "node": ">=24"

11 },

12 "scripts": {

13 "build": "tsc -p tsconfig.build.json && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",

14 "dev": "tsx src/index.ts",

15 "dev:daemon": "tsx src/daemon.ts",

16 "test": "vitest",

17 "lint": "eslint src/",

18 "format": "prettier --write \"src/**/*.ts\"",

19 "format:check": "prettier --check \"src/**/*.ts\"",

20 "build:css": "tailwindcss --content src/dashboard/html.ts --minify",

21 "prepublishOnly": "npm test && npm run build",

22 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@modelcontextprotocol/sdk": "^1.29.0",

26 "@whiskeysockets/baileys": "7.0.0-rc13",

27 "better-sqlite3": "^12.10.0",

28 "commander": "^14.0.3",

29 "cron-parser": "^5.5.0",

30 "discord.js": "^14.26.4",

31 "node-telegram-bot-api": "^0.67.0",

32 "pino": "^10.3.1",

33 "qrcode-terminal": "^0.12.0",

34 "uuid": "^14.0.0"

35 },

36 "overrides": {

37 "undici": "6.27.0",

38 "form-data@<3": "2.5.6",

39 "form-data@>=4 <5": "4.0.6",

40 "qs@>=6 <7": "6.15.3",

41 "tough-cookie@<4.1.3": "4.1.4"

42 },

dist/tasks/scheduler.jsView file

Lines 1-28javascript

1import { CronExpressionParser } from 'cron-parser';

2import fs from 'node:fs';

3import path from 'node:path';

4import { exec } from 'node:child_process';

dist/version.jsView file

Lines 1-5javascript

1import { createRequire } from 'node:module';

2const require = createRequire(import.meta.url);

3const pkg = require('../package.json'

dist/util/paths.jsView file

Lines 1-29javascript

1import path from 'node:path';

2import os from 'node:os';

3import fs from 'node:fs';

4// Renamed from '.beecork' to '.beecork-pipe' when the pipe became `beecork-pipe`:

5// the `beecork` name (and `~/.beecork`) now belongs to the beecork coding agent.

6

dist/cli/doctor.jsView file

Lines 1-21javascript

1import fs from 'node:fs';

2import { execSync } from 'node:child_process';

3import { getConfig } from '../config.js';

4import { getDbPath, getPidPath, getBeecorkHome, getConfigPath, getMcpConfigPath, getWhatsappSessionPath, } from '../util/paths.js'

dist/cli/commands.jsView file

Lines 225-265javascript

225 if (latest === current) {

226 console.log(`Already up to date (v${current})`);

227 }

228 else {

229 console.log(`Update available: v${current} → v${