birdclaw@0.9.3: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

birdclaw@0.9.3: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/client/assets/query-client-DZ5C7UNo.jsView file

14`)}`:`${i}: ${a}`}else i=r,a=an(t,0),o=`${i}: ${a}`;n.length>0&&(o+=`\n ${n.join(` L15: `)}`),super(a),this._tag=e,this.traces=n,this[gg]=_g,this.name=i,this.stack=o}pipe(){return F(this,arguments)}toString(){return this.stack}[M](){return this.stack}},yg=class extend... L16: `).slice(1).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/query-client-DZ5C7UNo.jsView on unpkg · L14

dist/server/server.jsView file

625async function getStartManifest(matchedRoutes) { L626: const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-mm-2VYBo.js"); L627: const startManifest = tsrStartManifest();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/server.jsView on unpkg · L625

dist/server/assets/router-B874XqWN.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = birdclaw@0.9.2 matchedIdentity = npm:YmlyZGNsYXc:0.9.2 similarity = 0.930 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/assets/router-B874XqWN.jsView on unpkg

19import { jsx, jsxs } from "react/jsx-runtime"; L20: import nodeHTTP from "node:http"; L21: import { Readable } from "node:stream"; ... L33: import fs, { access } from "node:fs/promises"; L34: import { exec, execFile } from "node:child_process"; L35: import { promisify } from "node:util"; L36: import { lookup } from "node:dns/promises"; L37: import net from "node:net"; L38: import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib"; L39: //#region src/components/AccountSwitcher.tsx ... L625: function isTestEnvironment() { L626: return process.env.VITEST === "true";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/assets/router-B874XqWN.jsView on unpkg · L19

dist/cli/birdclaw.jsView file

17// src/lib/url-safety.ts L18: var PRIVATE_IPV4_RANGES = [ L19: ["0.0.0.0", 8], ... L242: return JSON.stringify( L243: sanitizeJsonUrls(JSON.parse(value)) L244: ); ... L1264: } L1265: const rootDir = process.env.BIRDCLAW_HOME?.trim() || path.join(os.homedir(), ".birdclaw"); L1266: cachedPaths = { ... L1485: } L1486: exec(sql) { L1487: this.db.exec(sql);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/birdclaw.jsView on unpkg · L17

Source & flagged code

5 flagged

dist/client/assets/query-client-DZ5C7UNo.jsView file

Lines 1-17javascript

1import{r as e}from"./rolldown-runtime-B-9mzPXz.js";import{t}from"./react-BwGzW7mM.js";import{Rn as n,_ as r,a as i,c as a,d as o,f as s,g as c,h as l,i as u,l as d,m as f,n as p,o as m,p as h,r as ee,s as g,t as te,u as _,v as ne}from"./schemas-CntsNLmN.js";var re={setTimeout:(e,t)=>setTimeout(e,t),clearTimeout:e=>clearTimeout(e),setInterval:(e,t)=>setInterval(e,t),clearInterval:e=>clearInterval(e)},ie=new class{#e=re;setTimeoutProvider(e){this.#e=e}setTimeout(e,t){return this.#e.setTimeout(e,t)}clearTimeout(e){this.#e.clearTimeout(e)}setInterval(e,t){return this.#e.setInterval(e,t)}clearInter ...

2`),Zo=(e,t)=>{let n=e.stack.split(`

3`),r=`${t}[cause]: ${n[0]}`;for(let e=1,i=n.length;e<i;e++)r+=`\n${t}${n[e]

4`):t.split(`

5`);for(let e=1;e<i.length;e++){if(i[e].includes(` at new BaseEffectError`)||i[e].includes(` at new YieldableError`)){e++;continue}if(i[e].includes(`Generator.next`)||i[e].includes(`effect_internal_function`))break;r.push(i[e].replace(/at .*effect_instruction_i.*\((.*)\)/,`at $1`).replace(/EffectPrimitive\.\w+/,`<anonymous>`))}if(n){let e=n,t=0;for(;e&&e._tag===`Span`&&t<10;){let n=ts.get(e);if(typeof n==`function`){let t=n();if(typeof t==`

6`)},rs=Symbol.for(`effect/SpanAnnotation`),is=e=>Yo(e,void 0,{emptyCase:()=>[],dieCase:(e,t)=>[Qo(t)],failCase:(e,t)=>[Qo(t)],interruptCase:()=>[],parallelCase:(e,t,

7`);if(n.length>2){let e=n[2].match(/at (.*)/);e&&(t.message+=` (defined at ${e[1]})`)}}if(t.stack){let e=t.stack.split(`

8`);e.splice(1,3),t.stack=e.join(`

9`)}return t},gs=e=>C(e,fs),_s=e=>C(e,os),vs=ms(new Map),ys=()=>vs,bs=(e,t)=>ms(new Map([[e.key,t]])),xs=y(3,(e,t,n)=>{let r=new Map(e.unsafeMap);return r.set(t.key,n),ms(r)}),Ss=S(`effect/Context/defaultValueCache`,()=>new Map),Cs=e=>{if(Ss.has(e.key))return Ss.get(e.key);let t=e.defaultValue();return Ss.set(e.key,t),t},ws=(e,t)=>e.unsafeMap.has(t.key)?e.unsafeMap.get(t.key):Cs(t),Ts=y(2,(e,t)=>{if(!e.unsafeMap.has(t.key)){if(os in t)return Cs(t);throw hs(t)}

10`).slice(1).join(`

11`)}`:this.toString()}}return Object.assign(e.prototype,Rn),e}(),ap=(e,t)=>{class n extends ip{_tag=t}return Object.assign(

12`).length;o=t.stack?`(${r}) ${t.stack.split(`

13`).slice(0,e+3).join(`

14`)}`:`${i}: ${a}`}else i=r,a=an(t,0),o=`${i}: ${a}`;n.length>0&&(o+=`

15 `)}`),super(a),this._tag=e,this.traces=n,this[gg]=_g,this.name=i,this.stack=o}pipe(){return F(this,

16`).slice(1).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/assets/query-client-DZ5C7UNo.jsView on unpkg · L14

17`)}`:this.toString()}}),e}(),g_=function(){return class extends h_{constructor(e){super(),e&&Object.assign(this,e)}}}(),__=e=>{class

Long lines were clipped for display.

dist/server/server.jsView file

Lines 605-645javascript

605}

606function getH3Event() {

607 const event = eventStorage.getStore();

608 if (!event) throw new Error(

dist/server/assets/router-B874XqWN.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = birdclaw@0.9.2 matchedIdentity = npm:YmlyZGNsYXc:0.9.2 similarity = 0.930 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server/assets/router-B874XqWN.jsView on unpkg

19import { jsx, jsxs } from "react/jsx-runtime"; L20: import nodeHTTP from "node:http"; L21: import { Readable } from "node:stream"; ... L33: import fs, { access } from "node:fs/promises"; L34: import { exec, execFile } from "node:child_process"; L35: import { promisify } from "node:util"; L36: import { lookup } from "node:dns/promises"; L37: import net from "node:net"; L38: import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib"; L39: //#region src/components/AccountSwitcher.tsx ... L625: function isTestEnvironment() { L626: return process.env.VITEST === "true";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/assets/router-B874XqWN.jsView on unpkg · L19

dist/cli/birdclaw.jsView file

17// src/lib/url-safety.ts L18: var PRIVATE_IPV4_RANGES = [ L19: ["0.0.0.0", 8], ... L242: return JSON.stringify( L243: sanitizeJsonUrls(JSON.parse(value)) L244: ); ... L1264: } L1265: const rootDir = process.env.BIRDCLAW_HOME?.trim() || path.join(os.homedir(), ".birdclaw"); L1266: cachedPaths = { ... L1485: } L1486: exec(sql) { L1487: this.db.exec(sql);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/birdclaw.jsView on unpkg · L17