codeseeker@2.0.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

codeseeker@2.0.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/services/data/semantic-graph/semantic-graph.jsView file

24patternName = generic_password severity = medium line = 24

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/services/data/semantic-graph/semantic-graph.jsView on unpkg · L24

dist/shared/post-execution-integration.jsView file

12const validation_cycle_1 = require("./validation-cycle"); L13: const child_process_1 = require("child_process"); L14: const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/shared/post-execution-integration.jsView on unpkg · L12

dist/shared/intelligent-cycle/services/security-scanning-service.jsView file

40severity: 'high', L41: description: 'Use of eval() can lead to code injection vulnerabilities' L42: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/shared/intelligent-cycle/services/security-scanning-service.jsView on unpkg · L40

bin/codeseeker.jsView file

10L11: const path = require('path'); L12: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/codeseeker.jsView on unpkg · L10

dist/utils/cache.jsView file

179const content = await fs.readFile(filePath, 'utf8'); L180: const data = JSON.parse(content); L181: // Check if expired

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/cache.jsView on unpkg · L179

dist/shared/change-assessment-system.jsView file

44const path = __importStar(require("path")); L45: const child_process_1 = require("child_process"); L46: class ChangeAssessmentSystem { ... L50: this.logger = logger_1.Logger.getInstance(); L51: this.claudeCodeApiUrl = process.env.CLAUDE_CODE_API_URL || 'http://localhost:3007'; L52: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shared/change-assessment-system.jsView on unpkg · L44

scripts/postinstall.jsView file

121// Claude Code - user-level config L122: { path: '.claude/CLAUDE.md', name: 'Claude Code', create: true }, L123: { path: '.claude/settings/claude_desktop_config.json', name: 'Claude Desktop', create: false }, // JSON needs special handling L124: L125: // Cursor - user-level rules L126: { path: '.cursor/rules', name: 'Cursor (global rules)', create: true }, L127: { path: '.cursorrules', name: 'Cursor (home)', create: true }, L128: ... L156: // Generic agent files in home directory L157: { path: 'AGENTS.md', name: 'Generic AGENTS.md', create: true }, L158: { path: '.ai/instructions.md', name: 'Generic AI instructions', create: true }, ... L282:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L121

dist/cli/quality/compilation-checker.jsView file

42const warnings = []; L43: const tscProcess = (0, child_process_1.spawn)('npx', ['tsc', '--noEmit'], { L44: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/quality/compilation-checker.jsView on unpkg · L42

dist/mcp/indexing-service.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/indexing-service.js#virtual:normalized:round1View on unpkg

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView file

16patternName = generic_password severity = medium line = 16

Medium

Secret Pattern

Hardcoded password in dist/cli/services/data/semantic-graph/services/graph-storage-service.js

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView on unpkg · L16

Source & flagged code

12 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "codeseeker",

3 "version": "2.0.2",

4 "description": "Graph-powered code intelligence for Claude Code. Semantic search + knowledge graph for better AI code understanding.",

5 "main": "dist/index.js",

6 "exports": {

7 ".": {

8 "types": "./dist/index.d.ts",

9 "default": "./dist/index.js"

10 },

11 "./lib": {

12 "types": "./dist/lib/index.d.ts",

13 "default": "./dist/lib/index.js"

14 }

15 },

16 "bin": {

17 "codeseeker": "bin/codeseeker.js"

18 },

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "build": "tsc && node -e \"require('fs').copyFileSync('src/cli/services/monitoring/file-scanning/file-scanner-config.json','dist/cli/services/monitoring/file-scanning/file-scanner-config.json')\"",

22 "dev": "tsx src/index.ts",

23 "start": "node dist/cli/codeseeker-cli.js",

24 "test": "jest --testPathIgnorePatterns \"/node_modules/\" \"tests/integration/e2e\" \"tests/contract\"",

25 "test:e2e": "jest tests/integration/e2e",

26 "test:contract": "jest --testMatch \"**/tests/contract/**/*.contract.test.ts\"",

27 "test:all": "jest",

28 "test:mutation": "stryker run",

29 "test:watch": "jest --watch",

30 "test:coverage": "jest --coverage --testPathIgnorePatterns \"/node_modules/\" \"tests/integration/e2e\" \"tests/contract\"",

31 "test:storage": "node scripts/run-storage-integration-tests.js",

32 "test:storage:embedded": "node scripts/run-storage-integration-tests.js --mode=embedded",

33 "test:storage:server": "node scripts/run-storage-integration-tests.js --mode=server",

34 "lint": "eslint src --ext .ts",

35 "lint:fix": "eslint src --ext .ts --fix",

36 "format": "prettier --write \"src/**/*.{ts,js,json}\"",

37 "typecheck": "tsc --noEmit",

38 "docker:up": "docker-compose up -d",

39 "docker:down": "docker-compose down",

40 "docker:logs": "docker-compose logs -f",

dist/cli/services/data/semantic-graph/semantic-graph.jsView file

Lines 4-44javascript

4 * SOLID Principles: Dependency Inversion - Coordinator depends on service abstractions

5 * Coordinates all semantic graph operations using focused services

6 */

7Object.defineProperty(exports

dist/shared/post-execution-integration.jsView file

Lines 1-32javascript

1"use strict";

2/**

3 * Post-Execution Integration System

4 *

5 * Ensures project compiles → tests pass → commits changes → merges branch → sets new snapshot

6 * Automatically fixes compilation/test issues and manages the complete integration workflow

7 */

8Object.defineProperty(exports, "__esModule", { value:

dist/shared/intelligent-cycle/services/security-scanning-service.jsView file

Lines 20-60javascript

20 patterns,

21 recommendations,

22 riskLevel

23 };

24 }

25 catch (error) {

26 this.logger.error('Smart security analysis failed:', error);

27

bin/codeseeker.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2

3/**

4 * Global CodeSeeker CLI entry point

5 * Enhanced for VS Code and multiple environment compatibility

6 */

7

8// Suppress dotenv v17+ "injecting env" log message

9process.env.DOTENV_CONFIG_QUIET = 'true';

10

dist/utils/cache.jsView file

Lines 159-199javascript

159}

160exports.CacheFactory = CacheFactory;

161// Simple file-based cache manager

162class FileCacheManager {

163 cacheDir;

164 defaultTTL;

165 logger;

dist/shared/change-assessment-system.jsView file

Lines 24-64javascript

24 ownKeys = Object.getOwnPropertyNames || function (o) {

25 var ar = [];

26 for (var k in o) if (Object.

scripts/postinstall.jsView file

121// Claude Code - user-level config L122: { path: '.claude/CLAUDE.md', name: 'Claude Code', create: true }, L123: { path: '.claude/settings/claude_desktop_config.json', name: 'Claude Desktop', create: false }, // JSON needs special handling L124: L125: // Cursor - user-level rules L126: { path: '.cursor/rules', name: 'Cursor (global rules)', create: true }, L127: { path: '.cursorrules', name: 'Cursor (home)', create: true }, L128: ... L156: // Generic agent files in home directory L157: { path: 'AGENTS.md', name: 'Generic AGENTS.md', create: true }, L158: { path: '.ai/instructions.md', name: 'Generic AI instructions', create: true }, ... L282:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L121

dist/cli/quality/compilation-checker.jsView file

42const warnings = []; L43: const tscProcess = (0, child_process_1.spawn)('npx', ['tsc', '--noEmit'], { L44: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/quality/compilation-checker.jsView on unpkg · L42

dist/mcp/indexing-service.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/indexing-service.js#virtual:normalized:round1View on unpkg

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView file

16patternName = generic_password severity = medium line = 16

Medium

Secret Pattern

Hardcoded password in dist/cli/services/data/semantic-graph/services/graph-storage-service.js

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView on unpkg · L16