emp-code@0.2.17: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

emp-code@0.2.17: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = emp-code@0.2.16 matchedIdentity = npm:ZW1wLWNvZGU:0.2.16 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/emp.jsView on unpkg

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' });

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L7

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L873: if (!id) { console.log(' cancelled'); return defaultId; } L874: const baseUrl = (await lifecycle.ask(' baseUrl (e.g. https://api.example.com): ')).trim(); L875: if (!/^https?:\/\//i.test(baseUrl)) { console.log(C.red + ' baseUrl must start with http(s)://' + C.r); return defaultId; } ... L1676: if (!fs.existsSync(abs)) { console.log(`File not found: ${abs}`); return; } L1677: const data = fs.readFileSync(abs); L1678: if (data.length > 8*1024*1024) { console.log(`Image too large ${(data.length/1024/1024).toFixed(1)}MB, max 8MB`); return; }

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/emp.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/emp.jsView on unpkg

5const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L5

lib/tools.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/tools.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> bin/emp.js -> lib/tools.js L4: const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/tools.jsView on unpkg · L4

181L182: try { require('child_process').execSync('where powershell', { stdio: 'ignore', windowsHide: true }); child = spawn(command, { cwd, windowsHide: true, shell: 'powershell.exe' }); } L183: catch { child = spawn(command, { cwd, windowsHide: true, shell: true }); }

High

Shell

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Lines 161-201javascript

161 const timeout = Math.min(Number(timeoutMs) || 60000, 300000);

162 return new Promise((resolve) => {

163 let child;

164 try {

165

166 if (process.platform === 'win32') {

167 const bashCandidates = [

168 'C:\\Program Files\\Git\\bin\\bash.exe',

169 'C:\\Program Files\\Git\\usr\\bin\\bash.exe',

170 'C:\\Program Files (x86)\\Git\\bin\\bash.exe',

171 ];

172 let bashPath = null;

173 try { for (const p of bashCandidates) { if (fs.existsSync(p)) { bashPath = p; break; } } } catch {}

174

175 if (!bashPath) {

176 try { require('child_process').execSync('where bash', { stdio: 'ignore', windowsHide: true }); bashPath = 'bash'; } catch {}

177 }

178 if (bashPath) {

179 child = spawn(command, { cwd, windowsHide: true, shell: bashPath });

180 } else {

181

182 try { require('child_process').execSync('where powershell', { stdio: 'ignore', windowsHide: true }); child = spawn(command, { cwd, windowsHide: true, shell: 'powershell.exe' }); }

183 catch { child = spawn(command, { cwd, windowsHide: true, shell: true }); }

High

Shell

Package source references shell execution.

lib/tools.jsView on unpkg · L181

184 }

185 } else {

186

187 let bashPath = null;

188 try {

189 if (fs.existsSync('/bin/bash')) bashPath = '/bin/bash';

190 else if (fs.existsSync('/usr/bin/bash')) bashPath = '/usr/bin/bash';

191 } catch {}

192 if (bashPath) child = spawn(command, { cwd, shell: bashPath });

193 else child = spawn(command, { cwd, shell: true });

194 }

195 } catch (e) {

196 return resolve({ success: false, error: e.message, exitCode: null, stdout: '', stderr: '' });

197 }

198 let stdout = ''; let stderr = ''; let timedOut = false; let settled = false;

199 const settle = (r) => { if (settled) return; settled = true; clearTimeout(timer); resolve(r); };

200 const killTree = () => {

201 timedOut = true;