brainforge-kit@0.3.0-beta.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

brainforge-kit@0.3.0-beta.0: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

brainforge.mjsView file

4import { fileURLToPath } from 'node:url'; L5: import { spawnSync } from 'node:child_process'; L6: import { initProject } from './init-project.mjs';

High

Child Process

Package source references child process execution.

brainforge.mjsView on unpkg · L4

runtime/scope-verify.mjsView file

39try { L40: return await import(pathToFileURL(enginePath).href); L41: } finally {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/scope-verify.mjsView on unpkg · L39

agent-kit/bootstrap/kimi-smoke.mjsView file

6import path from "node:path"; L7: import net from "node:net"; L8: import { spawn, spawnSync } from "node:child_process"; L9: import { once } from "node:events"; ... L13: const kit = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); L14: const executable = process.env.BRAINFORGE_KIMI_BIN || "kimi"; L15: const version = spawnSync(executable, ["--version"], { encoding: "utf8", windowsHide: true });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

agent-kit/bootstrap/kimi-smoke.mjsView on unpkg · L6

agent-kit/hooks/scope-guard.mjsView file

1122if (!tokens.length && targets.length) return { kind: "fsMutation", cmd: "redirect", paths: targets }; L1123: // `npx pkg@ver …` / `bunx …` / `pnpm dlx …` run the package: judge the package. L1124: tokens = unwrapRunner(tokens); ... L1130: L1131: // PowerShell .NET file API ([System.IO.File]::WriteAllText(...)) — a write L1132: // with no cmdlet and no shell operator. Paths hide inside the call: deny.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

agent-kit/hooks/scope-guard.mjsView on unpkg · L1122

agent-kit/bootstrap/selftest.shView file

•path = agent-kit/bootstrap/selftest.sh kind = build_helper sizeBytes = 12308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent-kit/bootstrap/selftest.shView on unpkg

Source & flagged code

5 flagged

brainforge.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { spawnSync } from 'node:child_process';

6import { initProject } from './init-project.mjs';

High

Child Process

Package source references child process execution.

brainforge.mjsView on unpkg · L4

7

8const root = path.dirname(fileURLToPath(import.meta.url));

9const generator = path.join(root, 'agent-kit/bootstrap/new-project.mjs');

10const usage = `Brainforge — advanced project-team generator

11

12 brainforge-kit init [--target <existing-project>]

13 node brainforge.mjs list

14 node brainforge.mjs answers --track web-saas --out answers.json

15 node brainforge.mjs create --answers answers.json --target ../my-project [--dry-run] [--no-git]

16 node brainforge.mjs doctor

17

18Edit the JSON before generation: name, runtimes, placeholders and scopes.

19Clients: claude, codex, kimi, gemini. Global settings remain unchanged.

20Creates instructions and agents, not application code or dependencies.

21For conversational setup without Node, open your assistant and say: Set up Brainforge for me.`;

22

23function fail(message) { console.error(message); process.exitCode = 2; }

24function parse(argv, allowed) {

runtime/scope-verify.mjsView file

Lines 19-59javascript

19// node runtime/scope-verify.mjs --owners src/a.tsx --root <project>

20// node runtime/scope-verify.mjs --scopes-drift --root <project> [--strict]

21// node runtime/scope-verify.mjs --catalog-scopes --track web-saas [--agents a,b] [--project name]

22// Exit 0 = nothing denied, 2 = at least one denial, 1 = could not verify.

23import fs from "node:fs";

24import path from "node:path";

25

agent-kit/bootstrap/kimi-smoke.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/** Optional integration check: local skill discovery, no model prompt or login. */

3import assert from "node:assert/strict";

4import fs from "node:fs";

5import os from "node:os";

agent-kit/hooks/scope-guard.mjsView file

Lines 1102-1142javascript

1102 continue;

1103 }

1104 if (first === "case" && !tokens[0].quoted) {

1105 const arm =

agent-kit/bootstrap/selftest.shView file

•path = agent-kit/bootstrap/selftest.sh kind = build_helper sizeBytes = 12308 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agent-kit/bootstrap/selftest.shView on unpkg