botmux@3.18.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

botmux@3.18.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

60"prepublishOnly": "npm run build", "postinstall": "node scripts/postinstall-bin.mjs", "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The postinstall hook runs automatically after installation.

package.jsonView on unpkg · L60

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

287const binDir = join(homedir(), '.botmux', 'bin'); const launcher = join(binDir, 'botmux'); // `exec` replaces the shell process, so signals/exit codes pass straight through // to the binary. No `node` anywhere in this launcher — that is the entire point. const content = `#!/bin/sh\nexec "${binary}" "$@"\n`;

Medium

Ai Review Evidence

For global installs, it writes an executable launcher under the user's home directory.

scripts/postinstall-bin.mjsView on unpkg · L287

361{ let ensurePathEntry = null; try { ({ ensurePathEntry } = await import('./install-path-entry.mjs')); } catch (err) { console.error(`[botmux] PATH helper unavailable (${err && err.message ? err.message : String(err)})`); } let written = [], skipped = []; if (ensurePathEntry) { try { const r = ensurePathEntry({ installDir: binDir }); ({ written, skipped } = r); for (const f of written) console.log(`[botmux] added ${binDir} to PATH in ${f} (${r.shell})`); for (const f of skipped) console.log(`[botmux] ${f} already puts ${binDir} on PATH`);

Medium

Ai Review Evidence

It then appends PATH configuration to the user's shell startup files, creating persistence across future shells.

scripts/postinstall-bin.mjsView on unpkg · L361

Source & flagged code

5 flagged

package.jsonView file

Lines 40-81json

40 "test": "vitest run --project unit",

41 "test:all": "vitest run",

42 "test:e2e": "vitest run --project e2e",

43 "test:bun": "node scripts/run-bun-tests.mjs",

44 "test:bun:self-check": "node scripts/run-bun-tests.mjs --self-check",

45 "test:bench": "tsx scripts/bench-tests.ts",

46 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

47 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

48 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

49 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

50 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

51 "test:e2e-browser": "tsx scripts/run-e2e.ts",

52 "report:dashboard": "tsx scripts/report-dashboard.ts",

53 "desktop:bundle": "node scripts/build-desktop-icons.mjs && esbuild src/desktop/main.ts --bundle --outfile=dist/desktop/main.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/preload.ts --bundle --outfile=dist/desktop/preload.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/renderer/app.ts --bundle --outfile=dist/desktop/renderer/app.js --platform=browser --format=iife && cp src/desktop/renderer/index.html dist/desktop/renderer/index.html && cp src/desktop/renderer/style.css dist/desktop/renderer/style.css && cp -R src/desktop/assets dist ...

54 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

55 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

56 "desktop:install:local": "bash src/desktop/install-local.sh",

57 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

58 "desktop:pack": "bun run desktop:pack:local",

59 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

60 "prepublishOnly": "npm run build",

61 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

62 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The postinstall hook runs automatically after installation.

package.jsonView on unpkg · L60

63 },

64 "dependencies": {

65 "@larksuiteoapi/node-sdk": "^1.64.0",

66 "@modelcontextprotocol/sdk": "^1.29.0",

67 "@xterm/addon-unicode11": "^0.9.0",

68 "@xterm/headless": "^6.0.0",

69 "croner": "^10.0.1",

70 "dotenv": "^17.3.1",

71 "markdown-it": "^14.1.1",

72 "pm2": "^6.0.0",

73 "proxy-agent": "^6.5.0",

74 "qrcode-terminal": "^0.12.0",

75 "react": "^19.2.7",

76 "react-dom": "^19.2.7",

77 "ws": "^8.19.0",

78 "yaml": "^2.9.0",

79 "zod": "^3.23.0"

80 },

81 "optionalDependencies": {

Long lines were clipped for display.

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

Lines 267-307javascript

267 timeout: 30_000,

268 env: { ...process.env, BOTMUX_INSTALL_PROBE: '1' },

269});

270if (probe.error || probe.status !== 0) {

Lines 341-381javascript

341// startup file says so. The two come apart whenever the installing shell has binDir

342// on PATH transiently, and botmux itself creates that situation: the daemon

343// prepends `~/.botmux/bin` to every CLI session's PATH (five `prependBotmuxBin`

344// call sites in worker.ts / worker-pool.ts). So `npm i -g botmux` run from inside a

345// botmux session — or any shell that merely exported the dir — wrote NO startup

346// file, printed NO hint, and exited 0; the next terminal then had no `botmux` at

347// all, because there is no `bin` field to fall back on. MEASURED with the real

348// script against an isolated HOME, changing only PATH:

349// PATH without binDir → writes ~/.zshenv + "open a new terminal" hint

350// PATH with binDir → zero files, zero output, exit 0 ← the reported bug

351// `ensurePathEntry` already asks the right question per file (`fileAlreadyHasEntry`,

352// which also recognises a line the user wrote by hand) and reports those as

353// `skipped`, so this outer check was redundant as well as wrong.

354//

355// ⚠️ FAIL-SOFT, and never `fail()`: the launcher is already installed and working

356// at this point, so a PATH edit that cannot happen must degrade to the printed

357// hint — not abort a successful install. That includes the sibling module simply

358// not being there: it ships via package.json `files`, and if a future edit drops

359// it (or a mirror repacks the tarball without it) the import throws. Guarding it

360// keeps `npm i -g botmux` succeeding either way.

361{

362 let ensurePathEntry = null;

363 try {

364 ({ ensurePathEntry } = await import('./install-path-entry.mjs'));

365 } catch (err) {

366 console.error(`[botmux] PATH helper unavailable (${err && err.message ? err.message : String(err)})`);

367 }

368 let written = [], skipped = [];

369 if (ensurePathEntry) {

370 try {

371 const r = ensurePathEntry({ installDir: binDir });

372 ({ written, skipped } = r);

Medium

Ai Review Evidence

It then appends PATH configuration to the user's shell startup files, creating persistence across future shells.

scripts/postinstall-bin.mjsView on unpkg · L361

373 for (const f of written) console.log(`[botmux] added ${binDir} to PATH in ${f} (${r.shell})`);

374 for (const f of skipped) console.log(`[botmux] ${f} already puts ${binDir} on PATH`);

375 for (const { file, error } of r.failed) console.error(`[botmux] could not update ${file}: ${error}`);

376 } catch (err) {

377 console.error(`[botmux] could not update your shell startup file: ${err && err.message ? err.message : String(err)}`);

378 }

379 }

380 if (written.length > 0) {

381 console.log('[botmux] open a new terminal (or re-source that file) and `botmux` will be on PATH');