betterstart-cli@0.0.23: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

betterstart-cli@0.0.23: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

54const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L224: // core-engine/utils/package-manager.ts L225: import { execFileSync } from "child_process"; L226: import fs3 from "fs"; ... L229: "pnpm-lock.yaml": "pnpm", L230: "package-lock.json": "npm", L231: "yarn.lock": "yarn", ... L246: try { L247: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L248: if (typeof pkg.packageManager === "string") {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L54

54Trigger-reachable chain: manifest.bin -> dist/cli.js L54: const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L224: // core-engine/utils/package-manager.ts L225: import { execFileSync } from "child_process"; L226: import fs3 from "fs"; ... L229: "pnpm-lock.yaml": "pnpm", L230: "package-lock.json": "npm", L231: "yarn.lock": "yarn", ... L246: try { L247: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L248: if (typeof pkg.packageManager === "string") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L54

•matchType = previous_version_dangerous_delta matchedPackage = betterstart-cli@0.0.22 matchedIdentity = npm:YmV0dGVyc3RhcnQtY2xp:0.0.22 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

39async function loadConfigFile(configPath) { L40: const { createJiti } = await import("jiti"); L41: const alias = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L39

Source & flagged code

4 flagged

dist/cli.jsView file

54const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L224: // core-engine/utils/package-manager.ts L225: import { execFileSync } from "child_process"; L226: import fs3 from "fs"; ... L229: "pnpm-lock.yaml": "pnpm", L230: "package-lock.json": "npm", L231: "yarn.lock": "yarn", ... L246: try { L247: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L248: if (typeof pkg.packageManager === "string") {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L54

54Trigger-reachable chain: manifest.bin -> dist/cli.js L54: const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L224: // core-engine/utils/package-manager.ts L225: import { execFileSync } from "child_process"; L226: import fs3 from "fs"; ... L229: "pnpm-lock.yaml": "pnpm", L230: "package-lock.json": "npm", L231: "yarn.lock": "yarn", ... L246: try { L247: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L248: if (typeof pkg.packageManager === "string") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L54

•matchType = previous_version_dangerous_delta matchedPackage = betterstart-cli@0.0.22 matchedIdentity = npm:YmV0dGVyc3RhcnQtY2xp:0.0.22 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

39async function loadConfigFile(configPath) { L40: const { createJiti } = await import("jiti"); L41: const alias = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L39