cli-jaw@2.2.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cli-jaw@2.2.6: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`package.json` runs `scripts/postinstall-guard.cjs` on install.
`dist/bin/postinstall.js` downloads and executes Claude’s installer by default unless skipped.
Postinstall installs `@upstash/context7-mcp` globally unless `CLI_JAW_SKIP_MCP_SERVERS` is set.
Postinstall downloads and executes Astral uv installer unless `CLI_JAW_SKIP_SKILL_DEPS` is set.

Evidence against

No credential harvesting or exfiltration logic found in inspected lifecycle files.
Remote installer URLs are explicit vendor endpoints, not concealed package-owned hosts.
Shared AI-agent skill paths are gated by `CLI_JAW_MIGRATE_SHARED_PATHS`; default path is isolated.
`initMcpConfig` writes only `~/.cli-jaw/mcp.json`; postinstall does not call cross-client sync.
Dynamic JWC SDK import occurs only during user-invoked JWC runtime use.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

WildcardDependency

scanned 1,433 file(s), 14.5 MB of source, external domains: 127.0.0.1, a.tile.openstreetmap.org, antigravity.google, api.anthropic.com, api.crossref.org, api.finance.naver.com, api.github.com, api.openai.com, api.stackexchange.com, api.telegram.org, api.voyageai.com, arxiv.org, astral.sh, auth.x.ai, b.tile.openstreetmap.org, c.tile.openstreetmap.org, c2.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, chatgpt.com, chevrotain.io, claude.ai, cli-chat-proxy.grok.com, core.telegram.org, cursor.com, dev.to, discord.com, docs.anthropic.com, en.wikipedia.org, example.com, example.org, export.arxiv.org, fonts.googleapis.com, fonts.gstatic.com, gemini.google.com, generativelanguage.googleapis.com, github.com, grok.com, hacker-news.firebaseio.com, help.openai.com, hn.algolia.com, jaw.local, kiro.dev, langium.org, location-aiplatform.googleapis.com, mcp.context7.com, mcp.example.com, medium.com, news.ycombinator.com, nodejs.org

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-guard.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/postinstall.jsView file

24import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js';

High

Child Process

Package source references child process execution.

dist/bin/postinstall.jsView on unpkg · L24

152function persistWindowsUserPathDir(dir) { L153: const ps = process.env["SystemRoot"] ? path.join(process.env["SystemRoot"], 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') : 'powershell'; L154: const script = `

High

Shell

Package source references shell execution.

dist/bin/postinstall.jsView on unpkg · L152

5console.error(`[jaw:init] ❌ Node.js >= 22 required (current: ${process.version})`); L6: console.error(`[jaw:init] Install: https://nodejs.org or nvm install 22`); L7: process.exit(1); ... L24: import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js'; ... L33: const JAW_HOME = (() => { L34: if (!process.env["CLI_JAW_HOME"]) L35: return path.join(os.homedir(), '.cli-jaw'); L36: const resolved = resolveHomePath(process.env["CLI_JAW_HOME"]); ... L45: const jawHome = JAW_HOME; L46: const PATH_LOOKUP_CMD = process.platform === 'win32' ? 'where' : 'which';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/postinstall.jsView on unpkg · L5

19* Shared home paths (~/.agents, ~/.agent, ~/.claude) are NOT modified by default. L20: * Opt-in: CLI_JAW_MIGRATE_SHARED_PATHS=1 npm install -g cli-jaw L21: */ ... L24: import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/postinstall.jsView on unpkg · L19

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView file

98// eslint-disable-next-line no-new-func -- vendored bundle injection on CSP-strict pages L99: new Function(src)(); L100: }, source);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView on unpkg · L98

dist/src/agent/jwc-runtime.jsView file

31const spec = override && override.trim() ? override.trim() : DEFAULT_JWC_SDK_SPEC; L32: sdkPromise = import(spec).catch(err => { L33: sdkPromise = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/agent/jwc-runtime.jsView on unpkg · L31

dist/src/ide/diff.jsView file

7*/ L8: import { execFileSync, execFile } from 'node:child_process'; L9: import { writeFileSync, mkdtempSync, mkdirSync, statSync, realpathSync, rmSync, readFileSync } from 'node:fs'; ... L139: // Antigravity: 여러 env 시그널 확인 (VS Code 포크라서 VSCODE_* 도 공존) L140: if (process.env["ANTIGRAVITY_AGENT"] === '1') L141: return 'antigravity';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/ide/diff.jsView on unpkg · L7

dist/bin/commands/service.jsView file

9*/ L10: import { execFileSync, spawn as nodeSpawn } from 'node:child_process'; L11: import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'node:fs'; ... L52: function detectBackend() { L53: if (process.platform === 'darwin') L54: return 'launchd'; ... L87: console.log(`📋 macOS launchd logs:\n`); L88: console.log(` stdout: ${logDir}/jaw-serve.log`); L89: console.log(` stderr: ${logDir}/jaw-serve.err\n`); ... L102: ]; L103: process.env["_CLI_JAW_SERVICE_DELEGATE"] = '1'; L104: await import('./launchd.js');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/commands/service.jsView on unpkg · L9

dist/lib/quota-copilot.jsView file

7// L8: // Source: https://docs.github.com/copilot — official credential order L9: import { execFileSync } from 'child_process'; L10: import fs from 'fs'; ... L14: import { stripUndefined } from '../src/core/strip-undefined.js'; L15: const JAW_HOME = process.env["CLI_JAW_HOME"] L16: ? resolveHomePath(process.env["CLI_JAW_HOME"])

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/quota-copilot.jsView on unpkg · L7

public/dist/assets/chunk-NNHCCRGN-D69GtSOc.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Oa(e){let t=typeof e==`string`?new RegExp(e):e;return Da.some(e=>t.test(e))}o(Oa,`isWhitespace`);function ka(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(ka,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

public/dist/assets/chunk-NNHCCRGN-D69GtSOc.jsView on unpkg · L46

scripts/check-deps-online.shView file

•path = scripts/check-deps-online.sh kind = build_helper sizeBytes = 912 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-deps-online.shView on unpkg

public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 32-72json

32 "url": "https://github.com/lidge-jun/cli-jaw/issues"

33 },

34 "engines": {

35 "node": ">=22.4.0"

36 },

37 "bin": {

38 "cli-jaw": "dist/bin/cli-jaw.js",

39 "jaw": "dist/bin/cli-jaw.js"

40 },

41 "files": [

42 "dist/",

43 "!dist/src/lib/native/*.node",

44 "public/",

45 "scripts/",

46 "package.json"

47 ],

48 "scripts": {

49 "dev": "tsx --env-file=.env server.ts",

50 "ensure:native": "node scripts/ensure-native-modules.cjs",

51 "rebuild:native": "npm rebuild better-sqlite3",

52 "postinstall": "node scripts/postinstall-guard.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

53 "clean:dist": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});\"",

54 "build:claude-e": "cargo build --release --manifest-path native/claude-e/Cargo.toml",

55 "test:claude-e": "cargo test --manifest-path native/claude-e/Cargo.toml",

56 "build:claude-exec": "npm run build:claude-e",

57 "test:claude-exec": "npm run test:claude-e",

58 "check:copilot-gap": "tsx scripts/check-copilot-gap.ts",

59 "check:deps": "tsx scripts/check-deps-offline.ts",

60 "check:strict-baseline": "node scripts/check-strict-baseline.mjs",

61 "docs:check": "tsx scripts/docs/check-docs.mts",

62 "check:frontend-build-output": "tsx scripts/check-web-ui-build-output.ts",

63 "i18n:registry": "tsx scripts/i18n-registry.ts",

64 "check:deps:online": "bash scripts/check-deps-online.sh",

65 "prebuild": "npm run ensure:native",

66 "pretest": "npm run ensure:native",

67 "pretest:all": "npm run ensure:native",

68 "pretest:integration": "npm run ensure:native",

69 "pretest:smoke": "npm run ensure:native",

70 "test": "tsx --experimental-test-module-mocks tests/run.mts",

71 "test:all": "tsx --experimental-test-module-mocks tests/run.mts --all",

72 "test:integration": "tsx --experimental-test-module-mocks --test tests/integration/*.test.ts",

dist/bin/postinstall.jsView file

Lines 4-44javascript

4if (major < 22) {

5 console.error(`[jaw:init] ❌ Node.js >= 22 required (current: ${process.version})`);

6 console.error(`[jaw:init] Install: https://nodejs.org or nvm install 22`);

7 process.exit(1

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView file

Lines 78-114javascript

78}

79async function injectBundle(page, source) {

80 const alreadyInjected = await page

81 // @strict-allow-any(in-page global probe)

dist/src/agent/jwc-runtime.jsView file

Lines 11-51javascript

11// session.subscribe(listener) → unsubscribe ; session.isStreaming ; session.dispose()

12//

13// The engine is loaded lazily by dynamic import so this module compiles before

14// the jwc package is linked (100 in flight). Resolution order:

15// 1. JWC_SDK_PATH env (absolute path to dist-node/sdk.js — dev/CI)

16// 2. "jawcode/sdk" package export (separately installed package path)

17import { homedir } from 'node:os';

18import { join }

dist/src/ide/diff.jsView file

Lines 1-27javascript

1/**

2 * src/ide/diff.ts — IDE Diff View Module

3 * Git diff 감지 + IDE (Antigravity/VS Code) 연동

4 * 서버 변경 0줄 — jaw chat (TUI) 전용

5 *

6 * 접근법: before/after "dirty file set" 비교 (서브모듈 재귀 지원)

7 */

8import { execFileSync, execFile } from 'node:child_process';

9import { writeFileSync, mkdtempSync, mkdirSync, statSync, realpathSync, rmSync, readFileSync }

dist/bin/commands/service.jsView file

Lines 1-29javascript

1/**

2 * cli-jaw service — 크로스 플랫폼 서비스 관리

3 * Usage:

4 * jaw service — OS 감지 → 설치 + 시작 (원스텝)

5 * jaw service --port 3458 — 커스텀 포트로 등록

6 * jaw service status — 현재 상태 확인

7 * jaw service unset — 서비스 제거

8 * jaw service logs — 로그 보기

9 */

10import { execFileSync, spawn as nodeSpawn }

dist/lib/quota-copilot.jsView file

Lines 1-27javascript

1// ─── Copilot Quota: copilot_internal/user API ───────────────────

2// Token resolution order:

3// 1. ENV vars (COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN)

4// 2. File cache (~/.cli-jaw/auth/copilot-token) — no keychain popup

5// 3. `gh auth token` — cross-platform fallback

6// 4. macOS Keychain (one-shot, cached to file, suppress on failure)

7//

8// Source: https://docs.github.com/copilot — official credential order

9import { execFileSync } from 'child_process'

public/dist/assets/chunk-NNHCCRGN-D69GtSOc.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Oa(e){let t=typeof e==`string`?new RegExp(e):e;return Da.some(e=>t.test(e))}o(Oa,`isWhitespace`);function ka(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(ka,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

public/dist/assets/chunk-NNHCCRGN-D69GtSOc.jsView on unpkg · L46

scripts/check-deps-online.shView file

•path = scripts/check-deps-online.sh kind = build_helper sizeBytes = 912 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-deps-online.shView on unpkg

public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg