bot-relay-mcp: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

bot-relay-mcp: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/sqlite-compat.jsView file

124} L125: exec(sql) { L126: this.db.run(sql);

High

Child Process

Package source references child process execution.

dist/sqlite-compat.jsView on unpkg · L124

dist/cli/open.jsView file

12* linux → xdg-open <url> (or $BROWSER if set) L13: * win32 → start "" <url> (via cmd.exe /c) L14: *

High

Shell

Package source references shell execution.

dist/cli/open.jsView on unpkg · L12

122host = process.env.RELAY_HTTP_HOST || "127.0.0.1"; L123: port = process.env.RELAY_HTTP_PORT ? parseInt(process.env.RELAY_HTTP_PORT, 10) : 3777; L124: } ... L127: const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host; L128: url = `http://${loopback}:${port}/`; L129: } ... L137: try { L138: const child = spawn(driver.command, driver.args, { L139: stdio: "ignore",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/open.jsView on unpkg · L122

dist/cli/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = bot-relay-mcp@2.14.1 matchedIdentity = npm:Ym90LXJlbGF5LW1jcA:2.14.1 similarity = 0.882 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/init.jsView on unpkg

36import crypto from "crypto"; L37: import { execFileSync } from "child_process"; L38: import readline from "readline/promises"; ... L44: // v2.4.0 Part E — honor RELAY_HOME override (test harnesses + ops sandboxes). L45: if (process.env.RELAY_HOME) L46: return process.env.RELAY_HOME; L47: return path.join(os.homedir(), ".bot-relay"); L48: } ... L107: if (!v || !VALID_PROFILES.includes(v)) { L108: process.stderr.write(`--profile: expected one of ${VALID_PROFILES.join("/")}, got "${v}"\n`); L109: throw new Error("invalid --profile"); ... L208: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/init.jsView on unpkg · L36

bin/spawn-agent.shView file

•path = bin/spawn-agent.sh kind = build_helper sizeBytes = 18823 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/spawn-agent.shView on unpkg

Source & flagged code

6 flagged

dist/sqlite-compat.jsView file

Lines 104-144javascript

104 }

105 }

106}

107class WasmDatabase {

108 db;

109 dbPath;

110 txDepth = 0;

111 constructor(rawDb, dbPath) {

112 this.db = rawDb;

113 this.dbPath = dbPath;

114 // Attach conditional flush so WasmStatement can call it.

115 // Skips actual flush when inside a transaction (depth > 0) — the

116 // transaction() wrapper handles flushing at COMMIT/ROLLBACK.

117 this.db.__flush = () => {

118 if (this.txDepth === 0)

119 this.flush();

120 };

121 }

122 prepare(sql) {

123 return new WasmStatement(this.db, sql);

124 }

125 exec(sql) {

126 this.db.run(sql);

High

Child Process

Package source references child process execution.

dist/sqlite-compat.jsView on unpkg · L124

127 // v2.0 beta: respect txDepth so exec() inside a transaction doesn't flush

128 // mid-way. Calling export() between DDL statements inside an open

129 // transaction loses the in-memory state that hasn't yet been committed.

130 if (this.txDepth === 0)

131 this.flush();

132 return this;

133 }

134 pragma(source, _options) {

135 // Intercept WAL mode — wasm operates in-memory with write-back. WAL,

136 // DELETE, and other journal modes that touch the filesystem are meaningless

137 // (and may error on Emscripten's virtual FS). Simply no-op and return the

138 // current mode.

139 if (/journal_mode/i.test(source)) {

140 log.info("[db-wasm] journal_mode pragma skipped on wasm driver (in-memory + write-back).");

141 return "memory";

142 }

143 // busy_timeout has no effect on in-memory wasm (single-process, no locking).

144 if (/busy_timeout/i.test(source)) {

dist/cli/open.jsView file

Lines 1-32javascript

1// bot-relay-mcp

2// Copyright (c) 2026 Lumiere Ventures

3// SPDX-License-Identifier: MIT

4// See LICENSE for full terms.

5/**

6 * v2.2.2 C1 — `relay open` subcommand.

7 *

8 * Opens the dashboard URL in the operator's default browser. Reads

9 * RELAY_HTTP_HOST + RELAY_HTTP_PORT (or ~/.bot-relay/config.json),

10 * probes the daemon, and shells to the platform-native opener:

11 * darwin → open <url>

dist/cli/init.jsView file

Lines 16-56javascript

16 * 3. ~/.claude/settings.json — deep-merge the SessionStart hook (dedup by

17 * command path; preserve unrelated hooks).

18 * 4. macOS launchd — install + bootstrap a KeepAlive daemon plist,

19

bin/spawn-agent.shView file

•path = bin/spawn-agent.sh kind = build_helper sizeBytes = 18823 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/spawn-agent.shView on unpkg

Lines 102-142javascript

102 const u = new URL(url);

103 host = u.hostname || "127.0.0.1";

104 port = u.port ? parseInt(u.port, 10) : (u.protocol === "https:" ? 443 : 80);

105 }

106 catch {

107 process.stderr.write(`relay open: invalid --url value: ${args.url}\n`);

108 return 1;

109 }

110 }

111 else {

112 try {

113 const { loadConfig } = await import("../config.js");

114 const cfg = loadConfig();

115 host = cfg.http_host;

116 port = cfg.http_port;

117 }

118 catch (err) {

119 process.stderr.write(`relay open: could not load config: ${err instanceof Error ? err.message : String(err)}\n`);

120 // Fall back to defaults rather than bail — the dashboard URL is still

121 // useful to print + open.

122 host = process.env.RELAY_HTTP_HOST || "127.0.0.1";

123 port = process.env.RELAY_HTTP_PORT ? parseInt(process.env.RELAY_HTTP_PORT, 10) : 3777;

124 }

125 // When the bind is 0.0.0.0 / :: the dashboard isn't actually reachable

126 // via those hosts from a browser — use loopback instead.

127 const loopback = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;

128 url = `http://${loopback}:${port}/`;

129 }

130 const listening = await daemonListening(host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host, port);

131 process.stdout.write(`Opening ${url}\n`);

132 if (!listening) {

133 process.stdout.write(`Heads-up: the daemon does not appear to be listening on ${host}:${port}.\n` +

134 ` Start it with \`bot-relay-mcp --transport http\` (or \`both\`) and refresh.\n`);

135 }

136 const driver = pickDriver(process.platform, url);

137 try {

138 const child = spawn(driver.command, driver.args, {

139 stdio: "ignore",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/open.jsView on unpkg · L122

140 detached: true,

141 });

142 child.on("error", (err) => {