delimit-cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

delimit-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

gateway/ai/backends/tools_infra.pyView file

79patternName = aws_access_key severity = critical line = 79 matchedText = # we don...apes

Critical

Critical Secret

Package contains a critical-looking secret pattern.

gateway/ai/backends/tools_infra.pyView on unpkg · L79

79patternName = aws_access_key severity = critical line = 79 matchedText = # we don...apes

Critical

Secret Pattern

AWS access key ID in gateway/ai/backends/tools_infra.py

gateway/ai/backends/tools_infra.pyView on unpkg · L79

178patternName = aws_access_key severity = critical line = 178 matchedText = (re.comp...y"),

Critical

Secret Pattern

AWS access key ID in gateway/ai/backends/tools_infra.py

gateway/ai/backends/tools_infra.pyView on unpkg · L178

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L16: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L70: // Self-update check: ensure we're running the latest version (skip if already re-execed) L71: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L72: if (!process.env.DELIMIT_SETUP_UPDATED) { L73: try { ... L173: try { L174: execSync(`git clone --depth 1 https://github.com/delimit-ai/delimit-gateway.git "${path.join(DELIMIT_HOME, 'server')}" 2>/dev/null`, { stdio: 'pipe' }); L175: await logp(` ${green('✓')} Core engine cloned`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/delimit-setup.jsView on unpkg · L12

76log(dim(` Updating delimit-cli ${_pkg.version} -> ${latest}...`)); L77: execSync('npm install -g delimit-cli@latest 2>/dev/null', { stdio: 'pipe', timeout: 30000 }); L78: execSync('delimit-cli setup', { stdio: 'inherit', env: { ...process.env, DELIMIT_SETUP_UPDATED: '1' } });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/proxy-handler.jsView file

7L8: const { spawn } = require('child_process'); L9: const axios = require('axios'); L10: const path = require('path'); ... L12: L13: const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`; L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/proxy-handler.jsView on unpkg · L7

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/license_core.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 864488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/chat-repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = delimit-cli@4.16.1 matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.16.1 similarity = 0.969 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chat-repl.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 156-196json

156 "!scripts/demo-v420-deliberation.sh",

157 "!scripts/sync-gateway.sh",

158 "!scripts/build-license-core.sh",

159 "!scripts/security-check.sh",

160 "!scripts/check-bundle-parity.sh",

161 "!scripts/check-bundle-classification.sh",

162 "!scripts/list-blocked-gateway-paths.js",

163 "!scripts/test-license-core-so.sh",

164 "!scripts/test-with-config-guard.js",

165 "!scripts/verify-config-sentinel.js",

166 "server.json",

167 "README.md",

168 "LICENSE",

169 "CHANGELOG.md"

170 ],

171 "bin": {

172 "delimit": "./bin/delimit-cli.js",

173 "delimit-cli": "./bin/delimit-cli.js"

174 },

175 "scripts": {

176 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L176

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L176

177 "sync-gateway": "bash scripts/sync-gateway.sh",

178 "prepublishOnly": "node scripts/clean-tree-guard.js && bash scripts/publish-ci-guard.sh && bash scripts/check-bundle-classification.sh && npm run sync-gateway && bash scripts/build-license-core.sh && bash scripts/security-check.sh && bash scripts/check-bundle-parity.sh",

179 "test": "node scripts/test-with-config-guard.js",

180 "test:raw": "node --test tests/clean-tree-guard.test.js tests/_config-sentinel.test.js tests/setup-onboarding.test.js tests/setup-matrix.test.js tests/setup-no-clobber.test.js tests/config-export-import.test.js tests/cross-model-hooks.test.js tests/golden-path.test.js tests/v420-features.test.js tests/v43-wrap-engine.test.js tests/v43-trust-page-engine.test.js tests/v43-ai-sbom-engine.test.js tests/attest-mcp.test.js tests/delimit-home.test.js tests/postinstall-hardening.test.js tests/auth-signin.test.js tests/auth-signout.test.js tests/migration-2092-banner.test.js tests/control-browser.t ...

181 },

182 "keywords": [

183 "openapi",

184 "swagger",

185 "api",

186 "breaking-changes",

187 "semver",

188 "lint",

189 "linter",

190 "api-governance",

191 "api-contracts",

192 "ci-cd",

193 "github-actions",

194 "migration",

195 "diff",

196 "schema-validation",

Long lines were clipped for display.

gateway/ai/backends/tools_infra.pyView file

Lines 59-99python

59 # Test fixture patterns — fake keys like hosted-key-1, user-key-2, sk-test, gem-test

60 r"hosted[_-]key[_-]?\d*|user[_-]key[_-]?\d*|"

61 r"(?:codex|gem|grok)[_-]test|sk[_-]test|"

62 r"bad[:\-]token|fake[_-]?(?:key|token|secret)|"

63 # Demo/sample literal values used in docs, recordings, fixtures

64 r"sk-ant-demo|sk-demo|AIza-demo|xai-demo|demo[_-]?(?:key|secret|token)|"

65 r"-demo['\"]|"

66 # Function-call RHS (reading from parsed JSON, env, getters, slicing strings)

67 r"json\.loads|\.read_text\(|\.slice\(|\.split\(|"

68 r"\w+\.get\(|token\s*=\s*_make_token|"

69 # RHS that is a parameter reference like token=tokens.get("access_token"...

bin/delimit-setup.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * delimit setup — Install Delimit MCP governance tools into Claude Code.

4 *

5 * What it does:

6 * 1. Creates ~/.delimit/ directory with the MCP server + core engine

7 * 2. Adds "delimit" to Claude Code's MCP config (~/.mcp.json or .mcp.json)

8 * 3. Installs default agents into ~/.claude/agents/

9 * 4. Prints next steps

10 */

11const

lib/proxy-handler.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * Delimit Proxy Handler - Intercepts AI tool commands

5 * This module wraps AI tools (claude, gemini, codex) with governance

6 */

7

8const { spawn } = require('child_process');

9const

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/license_core.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 864488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/chat-repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = delimit-cli@4.16.1 matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.16.1 similarity = 0.969 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chat-repl.jsView on unpkg