claude-teammate@0.1.331: Suspicious npm security report (Warn)

Loading npm security reports…

claude-teammate@0.1.331: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

2 flagged

src/skills/fixer.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { createHash, randomBytes } from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/skills/fixer.jsView on unpkg · L1

3import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";

4import { tmpdir } from "node:os";

5import path from "node:path";

6import process from "node:process";

7import { promisify } from "node:util";

8import { buildGitEnvForRepoUrl, parseRepoUrl } from "../forge/repo-host.js";

9import { contentHash, IntakeDisabledError, IntakeValidationError, submitCandidate } from "../skillhub/candidates.js";

10import { listApprovedSkills } from "../skillhub/catalog.js";

11import { hasRecentDuplicateDraft, recordAuthoringEvent, triggerKindFor } from "./authoring-events.js";

13const execFileAsync = promisify(execFile);

15// Per-skill cap on .backups/<ts>/ snapshots. Oldest pruned after each successful write.

16let SKILL_BACKUP_MAX = 5;

18// Two-strategy schema: "patch" returns minimal oldString/newString edits (cheap,

19// low-regression). "rewrite" returns full file contents (needed for restructure /

20// new files / scattered changes). Caller branches on `strategy`.

21const SKILL_FIX_SCHEMA = {

src/commands/start.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-teammate@0.1.323 matchedIdentity = npm:Y2xhdWRlLXRlYW1tYXRl:0.1.323 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/start.jsView on unpkg

Source & flagged code

2 flagged · loading source

src/skills/fixer.jsView file

1import { execFile } from "node:child_process"; L2: import { createHash, randomBytes } from "node:crypto"; ... L271: */ L272: export function sk[redacted](env = process.env) { L273: return Boolean(String(env.DATABASE_URL || "").trim()); ... L659: try { L660: const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], { L661: cwd: projectRoot, ... L923: "curl", L924: ["-sf", "--max-time", "30", "-H", `PRIVATE-TOKEN: ${token}`, url], L925: { encoding: "utf8", timeout: 35000 } L926: );

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/skills/fixer.jsView on unpkg · L1

src/commands/start.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/start.jsView on unpkg

claude-teammate@0.1.331

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code