Loading npm security reports…

codex-overleaf-link@1.8.0: Clean npm security report (Allow) | LPM Firewall

registry / codex-overleaf-link / 1.8.0

codex-overleaf-link@1.8.0

Cross-platform Chrome bridge that connects Codex to the active Overleaf project.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 783 KB of source, external domains: github.com

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

native-host/src/taskRunnerRuntime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-overleaf-link@1.7.5 matchedIdentity = npm:Y29kZXgtb3ZlcmxlYWYtbGluaw:1.7.5 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

native-host/src/taskRunnerRuntime.jsView on unpkg

Source & flagged code

2 flagged · loading source

native-host/src/subagentBroker.jsView file

145

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

native-host/src/taskRunnerRuntime.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

native-host/src/taskRunnerRuntime.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code