docsync-agent@1.0.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

docsync-agent@1.0.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/commands/start.jsView file

45async function startCommand() { L46: const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) L47: ? path.join(process.cwd(), '.docsync', 'config.json') ... L52: } L53: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); L54: if (!config.token) { ... L58: const projectPath = process.cwd(); L59: const apiUrl = 'https://docsync-api.onrender.com'; L60: console.log(chalk_1.default.bold('\nDocSync started! 🚀')); ... L67: headers: { 'Content-Type': 'application/json' }, L68: body: JSON.stringify({ refreshToken: config.refreshToken }) L69: });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

58const projectPath = process.cwd(); const apiUrl = 'https://docsync-api.onrender.com'; console.log(chalk_1.default.bold('\nDocSync started! 🚀')); console.log(chalk_1.defaul

Low

Ai Review Evidence

The start command uses the current project and a fixed DocSync service endpoint.

dist/commands/start.jsView on unpkg · L58

package.jsonView file

5"main": "dist/index.js", "bin": { "docsync": "dist/index.js" }, "files": [ "dist/", "README.md", "LICENSE" ], "scripts": { "build": "tsc -p ./", "start": "node dist/index.js" }, "keywords": [ "documentation

Low

Suspicious Lifecycle Evidence

The manifest exposes a CLI and only declares build and start scripts; it has no install lifecycle hook.

package.jsonView on unpkg · L5

dist/services/watcher.jsView file

102async function generateDoc(config, apiUrl, relativePath, code) { const cleanCode = Buffer.from(code).toString('utf8').replace(/[\x00-\x1F\x7F]/g, ' '); const response = await fetch(`${apiUrl}/docs/generate`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${config.token}` }, body: JSON.stringify((0, utils_1.buildRequestBody)(config, relativePath, cleanCode)) }); return { response, data: await response.json() }; } f

Low

Ai Review Evidence

The watcher sends code only when the user invokes the documented watching workflow, using the configured service token.

dist/services/watcher.jsView on unpkg · L102

Source & flagged code

4 flagged

dist/commands/start.jsView file

Lines 25-78javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.startCommand = startCommand;

40const chalk_1 = __importDefault(require("chalk"));

41const watcher_1 = require("../services/watcher");

42const fs = __importStar(require("fs"));

43const path = __importStar(require("path"));

44const os = __importStar(require("os"));

45async function startCommand() {

46 const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json'))

47 ? path.join(process.cwd(), '.docsync', 'config.json')

48 : path.join(os.homedir(), '.docsync', 'config.json');

49 if (!fs.existsSync(configPath)) {

50 console.log(chalk_1.default.red('Not authenticated. Run docsync init first.'));

51 process.exit(1);

52 }

53 const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

54 if (!config.token) {

55 console.log(chalk_1.default.red('No token found. Run docsync init first.'));

56 process.exit(1);

57 }

58 const projectPath = process.cwd();

59 const apiUrl = 'https://docsync-api.onrender.com';

60 console.log(chalk_1.default.bold('\nDocSync started! 🚀'));

61 console.log(chalk_1.default.gray('Press Ctrl+C to stop\n'));

Low

Ai Review Evidence

The start command uses the current project and a fixed DocSync service endpoint.

dist/commands/start.jsView on unpkg · L58

62 (0, watcher_1.startWatcher)(projectPath, apiUrl);

63 const refreshAccessToken = async () => {

64 try {

65 const res = await fetch(`${apiUrl}/auth/refresh`, {

66 method: 'POST',

67 headers: { 'Content-Type': 'application/json' },

68 body: JSON.stringify({ refreshToken: config.refreshToken })

69 });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

70 const data = await res.json();

71 if (data.access_token) {

72 config.token = data.access_token;

73 config.refreshToken = data.refresh_token;

74 fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

75 }

76 }

77 catch (e) { }

78 };

package.jsonView file

Lines 1-25json

1{

2 "name": "docsync-agent",

3 "version": "1.0.1",

4 "description": "AI documentation that writes itself — auto-generates and syncs docs when your code changes",

5 "main": "dist/index.js",

6

dist/services/watcher.jsView file

Lines 82-122javascript

82 const response = await fetch(`${utils_1.API_URL}/auth/google/refresh`, {

83 method: 'POST',

84 headers: { 'Content-Type': 'application/json' },