Loading npm security reports…

bossmate@0.1.0: Suspicious npm security report (Warn) | LPM Firewall

registry / bossmate / 0.1.0

bossmate@0.1.0

AI-native BOSS job-search skill with local browser control, evidence gates, and recruiter deduplication.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 81.1 KB of source, external domains: 127.0.0.1, www.zhipin.com

Source & flagged code

5 flagged

skill/bossmate/scripts/test.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2const assert = require('assert');

3const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skill/bossmate/scripts/test.jsView on unpkg · L1

4const os = require('os');

5const path = require('path');

6const { spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

skill/bossmate/scripts/test.jsView on unpkg · L5

8const root = path.resolve(__dirname, '..');

9const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bossmate-test-'));

11function run(script, args = [], extraEnv = {}) {

12 return spawnSync(process.execPath, [path.join(__dirname, script), ...args], {

13 cwd: root,

14 encoding: 'utf8',

15 env: { ...process.env, BOSSMATE_HOME: home, ...extraEnv },

16 });

17}

19try {

20 let result = run('setup.js', [`--home=${home}`]);

21 assert.equal(result.status, 0, result.stderr);

22 assert(fs.existsSync(path.join(home, 'profile.md')));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

skill/bossmate/scripts/test.jsView on unpkg · L5

23 assert(fs.existsSync(path.join(home, 'preferences.json')));

24 assert(fs.existsSync(path.join(home, 'data', 'ledger.json')));

skill/bossmate/scripts/cdp.jsView file

Lines 23-63javascript

23 this.ws.addEventListener('open', res, { once: true });

24 this.ws.addEventListener('error', rej, { once: true });

25 this.ws.addEventListener('message',

skill/bossmate/scripts/setup-browser.ps1View file

•path = skill/bossmate/scripts/setup-browser.ps1 kind = build_helper sizeBytes = 1827 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/bossmate/scripts/setup-browser.ps1View on unpkg

Source & flagged code

5 flagged · loading source

skill/bossmate/scripts/test.jsView file

5const path = require('path'); L6: const { spawnSync } = require('child_process'); L7:

High

Child Process

Package source references child process execution.

skill/bossmate/scripts/test.jsView on unpkg · L5

5Cross-file remote execution chain: skill/bossmate/scripts/test.js spawns skill/bossmate/scripts/boss.js; helper contains network access plus dynamic code execution. L5: const path = require('path'); L6: const { spawnSync } = require('child_process'); L7: L8: const root = path.resolve(__dirname, '..'); L9: const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bossmate-test-')); ... L14: encoding: 'utf8', L15: env: { ...process.env, BOSSMATE_HOME: home, ...extraEnv }, L16: }); ... L20: let result = run('setup.js', [`--home=${home}`]); L21: assert.equal(result.status, 0, result.stderr); L22: assert(fs.existsSync(path.join(home, 'profile.md'))); ... L26: const preferencesFile = path.join(home, 'preferences.json');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

skill/bossmate/scripts/test.jsView on unpkg · L5

1#!/usr/bin/env node L2: const assert = require('assert'); L3: const fs = require('fs');

Findings

2 High5 Medium5 Low

HighChild Processskill/bossmate/scripts/test.js

HighCross File Remote Execution Contextskill/bossmate/scripts/test.js

MediumDynamic Requireskill/bossmate/scripts/test.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskill/bossmate/scripts/setup-browser.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalskill/bossmate/scripts/cdp.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings