emp-code@0.2.15: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

emp-code@0.2.15: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emp.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const os = require('os');

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L4

16} L17: console.error('emp binary not found. Run: npm install -g emp-code again, or download from https://github.com/saintdevzz/emp-cli/releases'); L18: process.exit(1); ... L21: if (fs.existsSync(exePath)) { L22: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); L23: child.on('close', code => process.exit(code == null ? 0 : code)); ... L25: } else { L26: const url = process.env.EMP_EXE_URL || `https://github.com/saintdevzz/emp-cli/releases/latest/download/${exeName}`; L27: console.log(`[emp] Downloading ${exeName}...`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/emp.jsView on unpkg · L16

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const os = require('os'); L7: L8: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L9: const exePath = process.pkg ? path.join(path.dirname(process.execPath), exeName) : path.join(__dirname, '..', 'dist', exeName); L10: const fallbackJs = process.pkg ? null : path.join(__dirname, 'emp-src.js'); ... L16: } L17: console.error('emp binary not found. Run: npm install -g emp-code again, or download from https://github.com/saintdevzz/emp-cli/releases'); L18: process.exit(1); ... L25: } else { L26: const url = process.env.EMP_EXE_URL || `https://github.com/saintdevzz/emp-cli/releases/latest/download/${exeName}`;

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

bin/emp.jsView on unpkg · L4

2'use strict'; L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L2

dist/emp-linuxView file

•path = dist/emp-linux kind = native_binary sizeBytes = 80172928 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/emp-linuxView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "emp-code",

3 "version": "0.2.15",

4 "description": "EMP CLI - coding agent with full-screen TUI (ink, clickable tool output, mouse, plan mode, markdown, vision) and 18 providers. Runs great on any light PC / weak CPU / old motherboard. Sessions, context, effort, web search, background tasks, revert.",

5 "type": "commonjs",

6 "bin": {

7 "emp": "bin/emp.js"

8 },

9 "engines": {

10 "node": ">=14"

11 },

12 "scripts": {

13 "start": "node bin/emp.js",

14 "test": "node -e \"console.log('no tests')\"",

15 "build": "node scripts/build-exe.js",

16 "build:win": "pkg . --target node22-win-x64 --output dist/emp-win.exe",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "prepublishOnly": "node scripts/prepare-publish.js",

19 "postpublish": "node scripts/restore-after-publish.js"

20 },

21 "keywords": [

22 "cli",

23 "ai",

24 "coding-agent",

25 "nvidia-nim",

26 "opencode-zen",

27 "no-avx",

28 "windows"

29 ],

30 "author": "",

31 "license": "UNLICENSED",

32 "repository": {

33 "type": "git",

34 "url": "https://github.com/saintdevzz/emp-cli.git"

35 },

36 "homepage": "https://github.com/saintdevzz/emp-cli#readme",

37 "bugs": {

bin/emp.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2'use strict';

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

dist/emp-linuxView file

•path = dist/emp-linux kind = native_binary sizeBytes = 80172928 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/emp-linuxView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg