claude-code-session-manager@0.35.17: Suspicious npm security | LPM Firewall

Loading npm security reports…

claude-code-session-manager@0.35.17: Suspicious npm security | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/whisperWorker-Dbia1OpC.jsView file

6${N} L7: }`,m=new Function(Object.keys(F),N)(...Object.values(F)),N=`methodCaller<(${b.map(j=>j.name)}) => ${g.name}>`,tN(Object.defineProperty(m,"name",{value:N}))}function oN(u,f){return ... L8: `),r)}p.validationMode&&Ar(o,"validationMode",p.validationMode,r)}let _=Se().webgpuRegisterDevice(h);if(_){let[p,w,v]=_;Ar(o,"deviceId",p.toString(),r),Ar(o,"webgpuInstance",w.toSt...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/whisperWorker-Dbia1OpC.jsView on unpkg · L6

bin/cli.cjsView file

5*/ L6: const { spawn } = require('node:child_process'); L7: const path = require('node:path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.cjsView on unpkg · L5

src/main/lib/definitionOfDone.cjsView file

13const path = require('node:path'); L14: const { spawn, spawnSync } = require('node:child_process'); L15: const { splitFrontmatter } = require('./prdFrontmatter.cjs'); ... L23: const RUNS_DIR = path.join( L24: os.homedir(), L25: '.claude', 'session-manager', 'scheduled-plans', 'runs' ... L266: clearTimeout(escalate); L267: const exitCode = typeof code === 'number' ? code : -1; L268: resolve({ ... L549: const raw = fs.readFileSync(path.join(runsDir, WATERMARK_FILENAME), 'utf8'); L550: const parsed = JSON.parse(raw); L551: return typeof parsed.lastFinishedAt === 'string' ? parsed.lastFinishedAt : null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/main/lib/definitionOfDone.cjsView on unpkg · L13

src/main/index.cjsView file

1Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, execution+network L1: const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, nativeImage, powerSaveBlocker, protocol } = require('electron'); L2: const { spawn, execFile, execFileSync } = require('node:child_process'); L3: const path = require('node:path'); ... L78: function startSystemdInhibit() { L79: if (process.platform !== 'linux') return; L80: // Idempotent: if a live child already holds the lock, don't spawn a second. L81: if (systemdInhibitChild && systemdInhibitChild.exitCode === null && !systemdInhibitChild.killed) return; L82: try { ... L150: L151: const REBOOT_LOG = path.join(os.homedir(), '.claude', 'sess

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

src/main/index.cjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = claude-code-session-manager@0.35.10 matchedIdentity = npm:[redacted]:0.35.10 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main/index.cjsView on unpkg

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView file

•path = dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm kind = wasm_module sizeBytes = 23567050 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView on unpkg

dist/vad/silero_vad_v5.onnxView file

•path = dist/vad/silero_vad_v5.onnx kind = high_entropy_blob sizeBytes = 2327524 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/vad/silero_vad_v5.onnxView on unpkg

dist/assets/monaco-editor-BW5C4Iv1.jsView file

•path = dist/assets/monaco-editor-BW5C4Iv1.js kind = oversized_source_file sizeBytes = 3809240 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/monaco-editor-BW5C4Iv1.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 10-50json

10 "files": [

11 "bin/",

12 ".claude-plugin/",

13 "plugins/",

14 "scripts/postinstall.cjs",

15 "src/main/",

16 "src/preload/",

17 "dist/index.html",

18 "dist/assets/",

19 "dist/vad/",

20 "screenshots/",

21 "README.md"

22 ],

23 "scripts": {

24 "dev": "concurrently -k -n vite,electron -c magenta,cyan \"npm:dev:renderer\" \"npm:dev:electron\"",

25 "dev:renderer": "vite",

26 "dev:electron": "wait-on http://localhost:5173 && SM_DEV=1 electron .",

27 "build": "vite build",

28 "typecheck": "tsc --noEmit",

29 "start": "electron .",

30 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "prepublishOnly": "vite build",

32 "test:unit": "vitest run",

33 "test:verify": "node src/main/__tests__/runVerify.test.cjs",

34 "test:e2e": "xvfb-run -a playwright test",

35 "smoke:darwin": "playwright test tests/smoke/darwin-boot.spec.ts",

36 "test:e2e:mic": "xvfb-run -a playwright test e2e/mic.spec.mjs",

37 "test:e2e:gen-fixture": "espeak-ng -w /tmp/sm-raw.wav -s 140 'testing one two three four five' && ffmpeg -y -i /tmp/sm-raw.wav -ar 48000 -ac 2 -sample_fmt s16 e2e/fixtures/speech.wav",

38 "refresh:vad-assets": "cp node_modules/@ricky0123/vad-web/dist/silero_vad_v5.onnx node_modules/@ricky0123/vad-web/dist/vad.worklet.bundle.min.js src/renderer/public/vad/ && cp node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.wasm node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.mjs node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.jsep.wasm node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.jsep.mjs src/renderer/public/vad/",

39 "health": "node src/main/health.cjs"

40 },

41 "keywords": [

42 "claude",

43 "claude-code",

44 "anthropic",

45 "terminal",

46 "electron",

47 "session-manager",

48 "cli",

49 "cockpit",

50 "mcp",

dist/assets/whisperWorker-Dbia1OpC.jsView file

6${N} L7: }`,m=new Function(Object.keys(F),N)(...Object.values(F)),N=`methodCaller<(${b.map(j=>j.name)}) => ${g.name}>`,tN(Object.defineProperty(m,"name",{value:N}))}function oN(u,f){return ... L8: `),r)}p.validationMode&&Ar(o,"validationMode",p.validationMode,r)}let _=Se().webgpuRegisterDevice(h);if(_){let[p,w,v]=_;Ar(o,"deviceId",p.toString(),r),Ar(o,"webgpuInstance",w.toSt...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/whisperWorker-Dbia1OpC.jsView on unpkg · L6

bin/cli.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * npx launcher for claude-code-session-manager.

4 * Spawns the Electron binary on the package root so main: src/main/index.cjs boots.

5 */

6const { spawn } = require('node:child_process');

7const path

src/main/lib/definitionOfDone.cjsView file

Lines 1-33javascript

1'use strict';

2

3/**

4 * definitionOfDone.cjs — pure helpers for the definition-of-done drain gate.

5 *

6 * No scheduler imports; no side effects beyond fs reads in reportExists.

7 * The scheduler wires these in (PRD 111).

8 */

9

10const crypto =

src/main/index.cjsView file

Lines 1-21javascript

1const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, nativeImage, powerSaveBlocker, protocol }

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView file

•path = dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasm kind = wasm_module sizeBytes = 23567050 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-simd-threaded.asyncify-DMmc6YqF.wasmView on unpkg

dist/vad/silero_vad_v5.onnxView file

•path = dist/vad/silero_vad_v5.onnx kind = high_entropy_blob sizeBytes = 2327524 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/vad/silero_vad_v5.onnxView on unpkg

dist/assets/monaco-editor-BW5C4Iv1.jsView file

•path = dist/assets/monaco-editor-BW5C4Iv1.js kind = oversized_source_file sizeBytes = 3809240 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/monaco-editor-BW5C4Iv1.jsView on unpkg