bridge-agent@0.19.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

bridge-agent@0.19.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefaul

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

32|| (${s} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,ae._)`+${o}`);return;case"boolean":n.elseIf((0,ae._)`${o} === "false" || ${o} === 0 || ${o} === null`).... L33: || ${s} === "boolean" || ${o} === null`).assign(a,(0,ae._)`[${o}]`)}}}function aM({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,ae._)`${e} !== undefined`,()=>t.assign((0,ae.... L34: missingProperty: ${n},

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L32

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Kv(t){r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Kv(t){r...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L10

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

28package = bridge-agent; repositoryIdentity = jerico; dependency = node-pty L28: \r L29: `+r)}function co(t,e,r,n,o,i){if(t.listenerCount("wsClientError")){let s=new Error(o);Error.captureStackTrace(s,co),t.emit("wsClientError",s,r,e)}else ms(r,n,o,i)}});var mk=E(Je=>{... L30: `:""},this._extScope=e,this._scope=new xr.Scope({parent:e}),this._nodes=[new vy]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L28

1Cross-file remote execution chain: dist/index.js spawns dist/bridge-mcp.cjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - spe

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

466Type "yes" to continue: `);let e="";process.stdin.setEncoding("utf-8"),process.stdin.resume(),process.stdin.on("data",r=>{e+=r,e.includes(` L467: `)&&(process.stdin.pause(),t(e.trim().toLowerCase()==="yes"))})})}var Lv=A(require("path")),cO=require("node:os");vt();var KZ=Lv.default.join((0,cO.homedir)(),"Library","LaunchAgen...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L466

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/bin/bridge-agent-macos-arm64View file

•path = dist/bin/bridge-agent-macos-arm64 kind = native_binary sizeBytes = 87705040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/bridge-agent-macos-arm64View on unpkg

dist/scripts/install-sim-prereqs.shView file

•path = dist/scripts/install-sim-prereqs.sh kind = build_helper sizeBytes = 5367 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/install-sim-prereqs.shView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "bridge-agent": "dist/index.js",

9 "bridge-mcp": "dist/bridge-mcp.cjs"

10 },

11 "files": [

12 "dist/",

13 "dist/scripts/",

14 "scripts/install-sim-prereqs.sh",

15 "scripts/postinstall.mjs",

16 "README.md",

17 "LICENSE"

18 ],

19 "engines": {

20 "node": ">=20"

21 },

22 "scripts": {

23 "build": "tsc --noEmit && node scripts/build.mjs",

24 "dev": "tsc --watch",

25 "typecheck": "tsc --noEmit",

26 "prepublishOnly": "npm run build",

27 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "pkg:build": "node scripts/pkg-build.mjs"

29 },

30 "keywords": [

31 "jerico",

32 "bridge",

33 "ai-agent",

34 "claude",

35 "qwen",

36 "kimi",

37 "terminal",

38 "pty"

39 ],

40 "author": "Jerico Team",

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/alperduzgun/jerico.git",

45 "directory": "packages/daemon"

46 },

47 "dependencies": {

dist/index.jsView file

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var yO=Object.create;var Bd=Object.defineProperty;var _O=Object.getOwnPropertyDescriptor;var vO=Object.getOwnPropertyNames;var bO=Object.getPrototypeOf,kO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=OO});var Xv=E(Yv=>{var NO=require("node:events").EventEmitter,tp=require("node:child_process"),Wr=require("node:path"),rp=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1

dist/bin/bridge-agent-macos-arm64View file

•path = dist/bin/bridge-agent-macos-arm64 kind = native_binary sizeBytes = 87705040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/bridge-agent-macos-arm64View on unpkg

dist/scripts/install-sim-prereqs.shView file

•path = dist/scripts/install-sim-prereqs.sh kind = build_helper sizeBytes = 5367 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/install-sim-prereqs.shView on unpkg