codex-overleaf-link@1.9.4: Clean npm security report (Allow)

Loading npm security reports…

codex-overleaf-link@1.9.4: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

native-host/src/updateManager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-overleaf-link@1.9.3 matchedIdentity = npm:Y29kZXgtb3ZlcmxlYWYtbGluaw:1.9.3 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

native-host/src/updateManager.jsView on unpkg

Source & flagged code

2 flagged · loading source

native-host/src/subagentBroker.jsView file

145try { L146: job = JSON.parse(fs.readFileSync(filePath, 'utf8')); L147: } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

native-host/src/updateManager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

native-host/src/updateManager.jsView on unpkg

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

native-host/src/updateManager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

native-host/src/updateManager.jsView on unpkg

codex-overleaf-link@1.9.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code