botmux@3.18.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

botmux@3.18.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

60"prepublishOnly": "npm run build", "postinstall": "node scripts/postinstall-bin.mjs", "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L60

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

205const binDir = join(homedir(), '.botmux', 'bin'); const launcher = join(binDir, 'botmux'); // `exec` replaces the shell process, so signals/exit codes pass straight through // to the binary. No `node` anywhere in this launcher — that is the entire point. const content = `#!/bin/sh\nexec "${binary}" "$@"\n`;

Medium

Ai Review Evidence

On global installs, the script writes a launcher under the user's home directory.

scripts/postinstall-bin.mjsView on unpkg · L205

scripts/install-path-entry.mjsView file

245for (const { file, line } of targets) { if (fileAlreadyHasEntry(file, installDir)) { skipped.push(file); continue; } try { mkdirSync(dirname(file), { recursive: true }); if (existsSync(file)) { // Keep the user's file intact; only append, and only with a leading // newline so we never glue onto an unterminated last line. const prev = readFileSync(file, 'utf8'); appendFileSync(file, `${prev.endsWith('\n') || prev === '' ? '' : '\n'}${line}\n`); } else { writeFileSync(file, `${line}\n`); } written.push(file);

Medium

Suspicious Lifecycle Evidence

The postinstall helper appends a PATH entry to shell startup files.

scripts/install-path-entry.mjsView on unpkg · L245

Source & flagged code

5 flagged

package.jsonView file

Lines 40-81json

40 "test": "vitest run --project unit",

41 "test:all": "vitest run",

42 "test:e2e": "vitest run --project e2e",

43 "test:bun": "node scripts/run-bun-tests.mjs",

44 "test:bun:self-check": "node scripts/run-bun-tests.mjs --self-check",

45 "test:bench": "tsx scripts/bench-tests.ts",

46 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

47 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

48 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

49 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

50 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

51 "test:e2e-browser": "tsx scripts/run-e2e.ts",

52 "report:dashboard": "tsx scripts/report-dashboard.ts",

53 "desktop:bundle": "node scripts/build-desktop-icons.mjs && esbuild src/desktop/main.ts --bundle --outfile=dist/desktop/main.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/preload.ts --bundle --outfile=dist/desktop/preload.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/renderer/app.ts --bundle --outfile=dist/desktop/renderer/app.js --platform=browser --format=iife && cp src/desktop/renderer/index.html dist/desktop/renderer/index.html && cp src/desktop/renderer/style.css dist/desktop/renderer/style.css && cp -R src/desktop/assets dist ...

54 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

55 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

56 "desktop:install:local": "bash src/desktop/install-local.sh",

57 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

58 "desktop:pack": "bun run desktop:pack:local",

59 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

60 "prepublishOnly": "npm run build",

61 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

62 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L60

63 },

64 "dependencies": {

65 "@larksuiteoapi/node-sdk": "^1.64.0",

66 "@modelcontextprotocol/sdk": "^1.29.0",

67 "@xterm/addon-unicode11": "^0.9.0",

68 "@xterm/headless": "^6.0.0",

69 "croner": "^10.0.1",

70 "dotenv": "^17.3.1",

71 "markdown-it": "^14.1.1",

72 "pm2": "^6.0.0",

73 "proxy-agent": "^6.5.0",

74 "qrcode-terminal": "^0.12.0",

75 "react": "^19.2.7",

76 "react-dom": "^19.2.7",

77 "ws": "^8.19.0",

78 "yaml": "^2.9.0",

79 "zod": "^3.23.0"

80 },

81 "optionalDependencies": {

Long lines were clipped for display.

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

Lines 185-225javascript

185 timeout: 30_000,

186 env: { ...process.env, BOTMUX_INSTALL_PROBE: '1' },

187});

188if (probe.error || probe.status !== 0) {

scripts/install-path-entry.mjsView file

Lines 225-264javascript

225 .map(t => t.replace(/\/+$/, ''))

226 .some(t => t !== ''