burnboard-cli@0.3.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

burnboard-cli@0.3.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

cli.mjsView file

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L30: const name = nameOverride || option("--name", args.find((value) => !value.startsWith("-"))); L31: const server = option("--server", "https://burnboard-public.vercel.app");

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.mjs: const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(installedVersionPath, `${cliVersion}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`); const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:body.token, profileUrl:body.profileUrl }, null, 2)}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.mjsView on unpkg

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L30: const name = nameOverride || option("--name", args.find((value) => !value.startsWith("-"))); L31: const server = option("--server", "https://burnboard-public.vercel.app");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 5757 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg

14printf '[2/5] Downloading tracker...\n'; curl -fsS "$SERVER_URL/burnboard-agent.mjs" -o "$INSTALL_DIR/agent.mjs"

Medium

Ai Review Evidence

Explicit setup downloads a remote JavaScript tracker, then persistence executes it every five minutes.

install/burnboard-setup.shView on unpkg · L14

Source & flagged code

5 flagged

cli.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

7

8const packageRoot = path.dirname(fileURLToPath(import.meta.url));

9const installRoot = path.join(packageRoot, "install");

10const burnboardRoot = path.join(os.homedir(), ".burnboard");

11const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version;

12const installedVersionPath = path.join(burnboardRoot, "cli-version");

13const lastUpdateCheckPath = path.join(burnboardRoot, "last-update-check");

14const command = process.argv[2] || "help";

15const args = process.argv.slice(3);

16

17function option(name, fallback) {

18 const index = args.indexOf(name);

19 return index >= 0 ? args[index + 1] : fallback;

20}

21

22function run(executable, runArgs) {

23 const result = spawnSync(executable, runArgs, { stdio: "inherit" });

24 if (result.error) throw result.error;

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.mjs: const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(installedVersionPath, `${cliVersion}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`); const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:body.token, profileUrl:body.profileUrl }, null, 2)}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.mjsView on unpkg

install/burnboard-setup.shView file

Lines 1-34text

1#!/usr/bin/env bash

2set -euo pipefail

3NAME="${1:?Usage: burnboard-setup.sh NAME [SERVER_URL]}"; SERVER_URL="${2:-https://burnboard-public.vercel.app}"

4command -v node >/dev/null || { echo "Node.js is required." >&2; exit 1; }

5INSTALL_DIR="$HOME/.burnboard"; CONFIG="$INSTALL_DIR/config.json"; mkdir -p "$INSTALL_DIR" "$HOME/.claude"

6printf '[1/5] Preparing BurnBoard profile...\n'

7if [[ -f "$CONFIG" ]] && node -e 'const c=JSON.parse(require("fs").readFileSync(process.argv[1]));process.exit(c.serverUrl===process.argv[2]&&c.token?0:1)' "$CONFIG" "$SERVER_URL"; then

8 TOKEN="$(node -e 'console.log(JSON.parse(require("fs").readFileSync(process.argv[1])).token)' "$CONFIG")"

9 PROFILE="$(node -e 'const c=JSON.parse(require("fs").readFileSync(process.argv[1]));console.log((c.profileUrl||(`/builder/${process.argv[2].toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"")||"builder"}`)).replace(/^\/intern\//,"/builder/"))' "$CONFIG" "$NAME")"

10