docsync-agent@1.0.2: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

docsync-agent@1.0.2: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/commands/start.jsView file

45async function startCommand() { L46: const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) L47: ? path.join(process.cwd(), '.docsync', 'config.json') ... L52: } L53: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); L54: if (!config.token) { ... L58: const projectPath = process.cwd(); L59: const apiUrl = 'https://docsync-api.onrender.com'; L60: console.log(chalk_1.default.bold('\nDocSync started! 🚀')); ... L67: headers: { 'Content-Type': 'application/json' }, L68: body: JSON.stringify({ refreshToken: config.refreshToken }) L69: });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

45async function startCommand() { const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) ? path.join(process.cwd(), '.docsync', 'config.json') : path.join(os.homedir(), '.docsync', 'config.json'); if (!fs.ex

Low

Ai Review Evidence

The start command requires DocSync configuration, then starts its watcher and contacts the package service endpoint.

dist/commands/start.jsView on unpkg · L45

58const projectPath = process.cwd(); const apiUrl = 'https://docsync-api.onrender.com'; console.log(chalk_1.default.bold('\nDocSync started! 🚀')); console.log(chalk_1.default.gray('Press Ctrl+C to stop\n')); (0, watcher_1.startWatcher)(projectPath, apiUrl); const refreshAccessToken = async () => { try { const res = await fetch(`${apiUrl}/auth/refresh`, { method: 'POS

Low

Ai Review Evidence

The start command requires DocSync configuration, then starts its watcher and contacts the package service endpoint.

dist/commands/start.jsView on unpkg · L58

package.jsonView file

5"main": "dist/index.js", "bin": { "docsync": "dist/index.js" }, "files": [ "dist/", "README.md", "LICENSE" ], "scripts": { "build": "tsc -p ./", "start": "node dist/index.js" }, "keywords":

Low

Suspicious Lifecycle Evidence

The manifest exposes a CLI and contains no npm install lifecycle hook.

package.jsonView on unpkg · L5

Source & flagged code

4 flagged

dist/commands/start.jsView file

Lines 25-78javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.startCommand = startCommand;

40const chalk_1 = __importDefault(require("chalk"));

41const watcher_1 = require("../services/watcher");

42const fs = __importStar(require("fs"));

43const path = __importStar(require("path"));

44const os = __importStar(require("os"));

45async function startCommand() {

46 const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json'))

47 ? path.join(process.cwd(), '.docsync', 'config.json')

48 : path.join(os.homedir(), '.docsync', 'config.json');

49 if (!fs.existsSync(configPath)) {

Low

Ai Review Evidence

The start command requires DocSync configuration, then starts its watcher and contacts the package service endpoint.

dist/commands/start.jsView on unpkg · L45

50 console.log(chalk_1.default.red('Not authenticated. Run docsync init first.'));

51 process.exit(1);

52 }

53 const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

54 if (!config.token) {

55 console.log(chalk_1.default.red('No token found. Run docsync init first.'));

56 process.exit(1);

57 }

58 const projectPath = process.cwd();

59 const apiUrl = 'https://docsync-api.onrender.com';

60 console.log(chalk_1.default.bold('\nDocSync started! 🚀'));

61 console.log(chalk_1.default.gray('Press Ctrl+C to stop\n'));

62 (0, watcher_1.startWatcher)(projectPath, apiUrl);

63 const refreshAccessToken = async () => {

64 try {

65 const res = await fetch(`${apiUrl}/auth/refresh`, {

66 method: 'POST',

Low

Ai Review Evidence

The start command requires DocSync configuration, then starts its watcher and contacts the package service endpoint.

dist/commands/start.jsView on unpkg · L58

67 headers: { 'Content-Type': 'application/json' },

68 body: JSON.stringify({ refreshToken: config.refreshToken })

69 });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L45

70 const data = await res.json();

71 if (data.access_token) {

72 config.token = data.access_token;

73 config.refreshToken = data.refresh_token;

74 fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

75 }

76 }

77 catch (e) { }

78 };

package.jsonView file

Lines 1-25json

1{

2 "name": "docsync-agent",

3 "version": "1.0.2",

4 "description": "AI documentation that writes itself — auto-generates and syncs docs when your code changes",

5 "main": "dist/index.js",

6