birdclaw@0.11.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

birdclaw@0.11.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/client/assets/query-client-CA-do_IS.jsView file

14`)}`:`${i}: ${a}`}else i=r,a=an(t,0),o=`${i}: ${a}`;n.length>0&&(o+=`\n ${n.join(` L15: `)}`),super(a),this._tag=e,this.traces=n,this[Fg]=Ig,this.name=i,this.stack=o}pipe(){return F(this,arguments)}toString(){return this.stack}[M](){return this.stack}},Rg=class extend... L16: `).slice(1).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/query-client-CA-do_IS.jsView on unpkg · L14

dist/server/server.jsView file

3518async function getStartManifest(matchedRoutes) { L3519: const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-DQT-Q-zz.js"); L3520: const startManifest = tsrStartManifest();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/server.jsView on unpkg · L3518

dist/server/assets/router-DY-ahyjD.jsView file

19import { jsx, jsxs } from "react/jsx-runtime"; L20: import nodeHTTP from "node:http"; L21: import { Readable } from "node:stream"; ... L32: import fs, { access } from "node:fs/promises"; L33: import { exec, execFile } from "node:child_process"; L34: import { promisify } from "node:util"; L35: import { createHash, randomUUID } from "node:crypto"; L36: import { lookup } from "node:dns/promises"; L37: import net from "node:net"; L38: import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib"; L39: import { Buffer as Buffer$1 } from "node:buffer"; ... L722: if (cachedPaths) return cachedPaths;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/assets/router-DY-ahyjD.jsView on unpkg · L19

dist/cli/birdclaw.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = birdclaw@0.9.4 matchedIdentity = npm:YmlyZGNsYXc:0.9.4 similarity = 0.674 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/birdclaw.jsView on unpkg

23if (value instanceof Uint8Array && !Buffer.isBuffer(value)) { L24: return Buffer.from(value.buffer, value.byteOffset, value.byteLength); L25: } ... L111: } L112: exec(sql) { L113: this.db.exec(sql); ... L179: } L180: const rootDir = process.env.BIRDCLAW_HOME?.trim() || path.join(os.homedir(), ".birdclaw"); L181: cachedPaths = { ... L329: function svgImageDataUrl(label, hue) { L330: const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800"><rect width="1200" height="800" fill="hsl(${String( L331: hue

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/birdclaw.jsView on unpkg · L23

Source & flagged code

5 flagged

dist/client/assets/query-client-CA-do_IS.jsView file

Lines 1-17javascript

1import{r as e}from"./rolldown-runtime-B-9mzPXz.js";import{t}from"./react-BwGzW7mM.js";import{Rn as n,_ as r,a as i,c as a,d as o,f as s,g as c,h as l,i as u,l as d,m as f,n as p,o as m,p as h,r as ee,s as g,t as te,u as _,v as ne}from"./schemas-CMQMhQXI.js";var re=class{constructor(){this.listeners=new Set,this.subscribe=this.subscribe.bind(this)}subscribe(e){return this.listeners.add(e),this.onSubscribe(),()=>{this.listeners.delete(e),this.onUnsubscribe()}}hasListeners(){return this.listeners.size>0}onSubscribe(){}onUnsubscribe(){}},ie=new class extends re{#e;#t;#n;constructor(){super(),this. ...

2`);if(n.length>2){let e=n[2].match(/at (.*)/);e&&(t.message+=` (defined at ${e[1]})`)}}if(t.stack){let e=t.stack.split(`

3`);e.splice(1,3),t.stack=e.join(`

4`)}return t},Ci=e=>C(e,yi),wi=e=>C(e,pi),Ti=xi(new Map),Ei=()=>Ti,Di=(e,t)=>xi(new

5`),rd=(e,t)=>{let n=e.stack.split(`

6`),r=`${t}[cause]: ${n[0]}`;for(let e=1,i=n.length;e<i;e++)r+=`\n${t}${n[e]}`;return e.cause&&(r+=` {\n${rd(e.cause,`${t} `)}\n${t}}`),r},id=e=>{let t=typeof e==`object`&&!!e,n=Error.stackTraceLimit;Error.stackTraceLimit=1;let r=Error(ad(e),t&&`cause`in e&&e.cause!==void 0?{cause:id(e.cause)}:void 0);return Error.stackTraceLimit=n,r.message===``&&(r.message=`An error has occurred`),Error.stackTraceLimit=n,r.name=e instanceof Error?e.name:`Error`,t&&(ld in e&&(r.span=e[ld]),Object.keys(e).forEach(t=>{t in r||(r[t]=e[t])})),r.stack=cd(`${r.name}: ${r.message}`,e instanceof Error&&e.stack?e.stac ...

7`):t.split(`

8`);for(let e=1;e<i.length;e++){if(i[e].includes(` at new BaseEffectError`)||i[e].includes(` at new YieldableError`)){e++;continue}if(i[e].includes(`Generator.next`

9`)},ld=Symbol.for(`effect/SpanAnnotation`),ud=e=>td(e,void 0,{emptyCase:()=>[],dieCase:(e,t)=>[id(t)],failCase:(e,t)=>[id(t)],interruptCase:()=>[],parallelCase:(e,t,n)=>[...t,...n],sequentialCase:(e,t,n)=>[...t,...n]}),dd=`Pending`,fd=`Done`,pd=Symbol.for(`effect/Deferred`),md={_E:e=>e,_A:e=>e},hd=e=>({_tag:dd,joiners:e}),gd=e=>({_tag:fd,effect:e}),_d=class e{self;called=!1;constructor(e){this.self=e}next(e){return this.called?{value:e,done:!0}:(this.called=!0,{value:this.self,done:!1})}return(e){return{value:e,done:!0}}throw(e){throw e}[Symbol.iterator](){return new e(this.self)}},vd=(e,t)=>{ ...

10`).slice(1).join(`

11`)}`:this.toString()}}return Object.assign(e.prototype,Rn),e}(),sp=(e,t)=>{class n extends op{_tag=t}return Object.assign(n.prototype,e),n.prototype.name=t,n},cp=Symbol.for(`effect/Cause/errors/RuntimeException`),lp=sp({[cp]:cp},`RuntimeException`),up=Symbol.for(`effect/Cause/errors/InterruptedException`),dp=sp({[up]:up},`InterruptedException`),fp=e=>C(e,up),pp=Symbol.for(`effect/Cause/errors/NoSuchElement`),mp=sp({[pp]:pp},`NoSuchElementException

12`).length;o=t.stack?`(${r}) ${t.stack.split(`

13`).slice(0,e+3).join(`

14`)}`:`${i}: ${a}`}else i=r,a=an(t,0),o=`${i}: ${a}`;n.length>0&&(o+=`\n ${n.join(`

15 `)}`),super(a),this._tag=e,this.traces=n,this[Fg]=Ig,this.name=i,this.stack=o}pipe(){return F(this,arguments)}toString(){return this.stack}[M](){return this.stack}},Rg=class extends Lg{error;constructor(e,t=[]){super(`Fail`,e,t),this.error=e}},zg=(e,t=[])=>new Rg(e,t),Bg=class extends Lg{defect;constructor(e,t=[]){super(`Die`,e,t),this.defect=e}},Vg=(e,t=[])=>new Bg(e,t),Hg=class extends Lg{constructor(e=[]){super(`Interrupt`,`interrupted`,e)}},Ug=(e=[])=>new Hg(e),Wg=e=>e._tag===`Interrupt`,Gg=Symbol.for(`effect/Micro/MicroFiber`),Kg={_A:b,_E:b},qg=class{context;interruptible;[Gg];_stack= ...

16`).slice(1).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/query-client-CA-do_IS.jsView on unpkg · L14

17`)}`:this.toString()}}),e}(),F_=function(){return class extends P_{constructor(e){super(),e&&Object.assign(this,e)}}}(),I_=e=>{class t extends F_{_tag=e}return t.prototype.name=e,t};I_(`NoSuchElementException`),I_(`TimeoutException`);var L_=class e{scheduleDrain;running=!1;tasks=new R_;constructor(e){this.scheduleDrain=e}starveInternal=e=>{let t=this.tasks.buckets;this.tasks.buckets=[];for(let[e,n]of t)for(let e=0;e<n.length;e++)n[e]();this.tasks.buckets.length===0?this.running=!1:this.starve(e)};starve(e=0){this.scheduleDrain(e,this.starveInternal)}scheduleTask(e,t){this.tasks.scheduleTask(e, ...

Long lines were clipped for display.

dist/server/server.jsView file

Lines 3498-3538javascript

3498 },

3499 serialize(e, r) {

3500 return "(" + r.serialize(e.factory) + ")(" + r.serialize(e.stream) + ")";

dist/server/assets/router-DY-ahyjD.jsView file

19import { jsx, jsxs } from "react/jsx-runtime"; L20: import nodeHTTP from "node:http"; L21: import { Readable } from "node:stream"; ... L32: import fs, { access } from "node:fs/promises"; L33: import { exec, execFile } from "node:child_process"; L34: import { promisify } from "node:util"; L35: import { createHash, randomUUID } from "node:crypto"; L36: import { lookup } from "node:dns/promises"; L37: import net from "node:net"; L38: import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib"; L39: import { Buffer as Buffer$1 } from "node:buffer"; ... L722: if (cachedPaths) return cachedPaths;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/assets/router-DY-ahyjD.jsView on unpkg · L19

dist/cli/birdclaw.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = birdclaw@0.9.4 matchedIdentity = npm:YmlyZGNsYXc:0.9.4 similarity = 0.674 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/birdclaw.jsView on unpkg

23if (value instanceof Uint8Array && !Buffer.isBuffer(value)) { L24: return Buffer.from(value.buffer, value.byteOffset, value.byteLength); L25: } ... L111: } L112: exec(sql) { L113: this.db.exec(sql); ... L179: } L180: const rootDir = process.env.BIRDCLAW_HOME?.trim() || path.join(os.homedir(), ".birdclaw"); L181: cachedPaths = { ... L329: function svgImageDataUrl(label, hue) { L330: const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800"><rect width="1200" height="800" fill="hsl(${String( L331: hue

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/birdclaw.jsView on unpkg · L23