docsync-agent: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

docsync-agent: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/commands/start.jsView file

45async function startCommand() { L46: const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) L47: ? path.join(process.cwd(), '.docsync', 'config.json') ... L52: } L53: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); L54: if (!config.token) { ... L58: const projectPath = process.cwd(); L59: const apiUrl = 'https://docsync-api.onrender.com'; L60: console.log(chalk_1.default.bold('\nDocSync started! 🚀')); ... L67: headers: { 'Content-Type': 'application/json' }, L68: body: JSON.stringify({ refreshToken: config.refreshToken }) L69: });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

45async function startCommand() { const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) ? path.join(process.cwd(), '.docsync', 'config.json') : path.join(os.homedir(), '.docsync', 'config.json'); if (!fs.existsSync(configPath)

Medium

Ai Review Evidence

The start command requires an existing DocSync configuration before starting its watcher.

dist/commands/start.jsView on unpkg · L45

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = docsync-agent@1.0.2 matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:1.0.2 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

52async function loginCommand() { const email = await ask('Email: '); const password = await ask('Password: '); const res = await fetch(`${utils_1.API_URL}/auth/signin`, { method: 'POST', headers: { 'Content-Type': 'applicat

Medium

Ai Review Evidence

The login command obtains credentials through interactive prompts and sends them to the fixed DocSync authentication API.

dist/commands/login.jsView on unpkg · L52

package.jsonView file

14"scripts": { "build": "tsc -p ./", "start": "node dist/index.js" }, "keywords": [ "documentation",

Medium

Suspicious Lifecycle Evidence

The package scripts contain only build and explicit start commands, with no npm install lifecycle hook.

package.jsonView on unpkg · L14

Source & flagged code

5 flagged

dist/commands/start.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.startCommand = startCommand;

40const chalk_1 = __importDefault(require("chalk"));

41const watcher_1 = require("../services/watcher");

42const fs = __importStar(require("fs"));

43const path = __importStar(require("path"));

44const os = __importStar(require("os"));

45async function startCommand() {

46 const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json'))

47 ? path.join(process.cwd(), '.docsync', 'config.json')

48 : path.join(os.homedir(), '.docsync', 'config.json');

49 if (!fs.existsSync(configPath)) {

Medium

Ai Review Evidence

The start command requires an existing DocSync configuration before starting its watcher.

dist/commands/start.jsView on unpkg · L45

50 console.log(chalk_1.default.red('Not authenticated. Run docsync init first.'));

51 process.exit(1);

52 }

53 const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

54 if (!config.token) {

55 console.log(chalk_1.default.red('No token found. Run docsync init first.'));

56 process.exit(1);

57 }

58 const projectPath = process.cwd();

59 const apiUrl = 'https://docsync-api.onrender.com';

60 console.log(chalk_1.default.bold('\nDocSync started! 🚀'));

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

61 console.log(chalk_1.default.gray('Press Ctrl+C to stop\n'));

62 (0, watcher_1.startWatcher)(projectPath, apiUrl);

63 const refreshAccessToken = async () => {

64 try {

65 const res = await fetch(`${apiUrl}/auth/refresh`, {

dist/commands/login.jsView file

Lines 32-72javascript

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return

package.jsonView file

Lines 1-34json

1{

2 "name": "docsync-agent",

3 "version": "1.0.3",

4 "description": "AI documentation that writes itself — auto-generates and syncs docs when your code changes",

5 "main": "dist/index.js",

6