chain-insights@0.8.19: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

chain-insights@0.8.19: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

bin/install.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = chain-insights@0.8.22 matchedIdentity = npm:Y2hhaW4taW5zaWdodHM:0.8.22 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.cjsView on unpkg

120const proxyBinPath = path.resolve(__dirname, 'mcp-proxy.cjs'); L121: const { execFileSync } = require('child_process'); L122:

High

Child Process

Package source references child process execution.

bin/install.cjsView on unpkg · L120

dist/cli.cjsView file

3Cross-file remote execution chain: dist/cli.cjs spawns dist/server-B5HlORyO.cjs; helper contains network access plus dynamic code execution. L3: let commander = require("commander"); L4: let node_child_process = require("node:child_process"); L5: let node_url = require("node:url"); ... L9: /** L10: * Prints the text blocks of an MCP tool result to stdout. When the result is L11: * flagged `isError`, throws with the tool's error text instead — MCP `callTool` ... L22: //#region src/cli.ts L23: const __dirname$1 = node_path.default.dirname((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href)); L24: const installerPath = node_path.default.resolve(__dirname$1, "..", "bin", "install.cjs"); ... L72: const { createConfiguredGraphMcpFetch, resolveGraphMcpEndpoint } = await Pro

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.cjsView on unpkg · L3

skills/test-chain-insights-graph/scripts/run-uat.shView file

•path = skills/test-chain-insights-graph/scripts/run-uat.sh kind = build_helper sizeBytes = 29120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/test-chain-insights-graph/scripts/run-uat.shView on unpkg

Source & flagged code

4 flagged

bin/install.cjsView file

Lines 100-140javascript

100

101// ─── 3. Write default config.json if absent ───────────────────────────────

102

103if (!fs.existsSync(configPath)) {

104 const defaultConfig = {

105 mcpEndpoint: 'http://localhost:4000',

106 mcpAuthToken: '',

107 walletAddress: '',

108 graphMcpMode: 'paid',

109 serverPort: 4321,

110 dataDir: dataDir,

111 version: '1',

112 };

113 fs.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2) + '\n', 'utf8');

114 // Owner-readable only — config may contain MCP auth token (ASVS L1 V4.3.2 / T-02-01)

115 fs.chmodSync(configPath, 0o600);

116}

117

118// ─── 4. Register MCP proxy in supported clients ───────────────────────────

119

120const proxyBinPath = path.resolve(__dirname, 'mcp-proxy.cjs');

121const { execFileSync } = require('child_process');

122

High

Child Process

Package source references child process execution.

bin/install.cjsView on unpkg · L120

123if (hasClaude) {

124 try {

125 execFileSync(

126 'claude',

127 ['mcp', 'add', 'chain-insights-proxy', '--scope', 'user', '--', 'node', proxyBinPath],

128 { stdio: 'pipe' }

129 );

130 console.log(` ${cyan}Claude MCP:${reset} registered (chain-insights-proxy) at ${proxyBinPath}`);

131 } catch {

132 console.log(` ${dim}Claude MCP:${reset} run manually: claude mcp add chain-insights-proxy --scope user -- node ${proxyBinPath}`);

133 }

134}

135

136function tomlQuoted(value) {

137 return JSON.stringify(value);

138}

139

140function installCodexMcp(configFile, proxyPath) {

•matchType = previous_version_dangerous_delta matchedPackage = chain-insights@0.8.22 matchedIdentity = npm:Y2hhaW4taW5zaWdodHM:0.8.22 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.cjsView on unpkg

dist/cli.cjsView file

Lines 1-23javascript

1const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");

2const require_version = require("./version-CO9Or_YV.cjs");

3let commander = require(

skills/test-chain-insights-graph/scripts/run-uat.shView file

•path = skills/test-chain-insights-graph/scripts/run-uat.sh kind = build_helper sizeBytes = 29120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/test-chain-insights-graph/scripts/run-uat.shView on unpkg