Loading npm security reports…

codex-overleaf-link@2.0.0: Clean npm security report (Allow) | LPM Firewall

registry / codex-overleaf-link / 2.0.0

codex-overleaf-link@2.0.0

Cross-platform Chrome bridge that connects Codex to the active Overleaf project.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 2.10 MB of source, external domains: github.com, overleaf.com, raw.githubusercontent.com, www.overleaf.com

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

extension/src/shared/compatibility.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codex-overleaf-link@1.9.13 matchedIdentity = npm:Y29kZXgtb3ZlcmxlYWYtbGluaw:1.9.13 similarity = 0.955 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extension/src/shared/compatibility.jsView on unpkg

Source & flagged code

2 flagged · loading source

native-host/src/subagentBroker.jsView file

Source & flagged code

2 flagged

native-host/src/subagentBroker.jsView file

Lines 125-165javascript

125 if (!name.endsWith('.json') || name.startsWith('.tmp-') || seenFiles.has(name)) {

126 continue;

127 }

128 seenFiles.add(name);

129 admitJobFile(name);

130 }

131 }

132

133 function admitJobFile(name) {

134 const filePath = path.join(jobsDir, name);

135 let stat;

136 try {

137 stat = fs.statSync(filePath);

138 } catch (_error) {

139 return;

140 }

141 if (stat.size > MAX_JOB_FILE_BYTES) {

142 return writeRejection({ id: idFromFileName(name), reason: 'job_too_large' });

143 }

144 let job;

145 try {

146 job = JSON.parse(fs.readFileSync(filePath, 'utf8'));

147 } catch (_error) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

native-host/src/subagentBroker.jsView on unpkg · L145

148 return writeRejection({ id: idFromFileName(name), reason: 'invalid_json' });

149 }

150 const rejection = validateJob(job);

151 if (rejection) {

152 return writeRejection({ id: jobIdOrFallback(job, name), ...rejection });

153 }

154 acceptedCount += 1;

155 jobs.set(job.id, { job, status: 'queued' });

156 queued.push(job.id);

157 emit('codex.subagent.queued', job.title || job.id, { jobId: job.id, files: job.files }, 'running');

158 }

159

160 function idFromFileName(name) {

161 return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';

162 }

163

164 function jobIdOrFallback(job, name) {

165 return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);

extension/src/shared/compatibility.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extension/src/shared/compatibility.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code