emp-code@0.2.26: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

emp-code@0.2.26: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = emp-code@0.2.27 matchedIdentity = npm:ZW1wLWNvZGU:0.2.27 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/emp.jsView on unpkg

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' });

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L7

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L907: if (!id) { console.log(' cancelled'); return defaultId; } L908: const baseUrl = (await lifecycle.ask(' baseUrl (e.g. https://api.example.com): ')).trim(); L909: if (!/^https?:\/\//i.test(baseUrl)) { console.log(C.red + ' baseUrl must start with http(s)://' + C.r); return defaultId; } ... L1710: if (!fs.existsSync(abs)) { console.log(`File not found: ${abs}`); return; } L1711: const data = fs.readFileSync(abs); L1712: if (data.length > 8*1024*1024) { console.log(`Image too large ${(data.length/1024/1024).toFixed(1)}MB, max 8MB`); return; }

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/emp.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/emp.jsView on unpkg

5const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L5

lib/tools.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/tools.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> bin/emp.js -> lib/tools.js L4: const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/tools.jsView on unpkg · L4

192L193: try { require('child_process').execSync('where powershell', { stdio: 'ignore', windowsHide: true }); child = spawn(command, { cwd, windowsHide: true, shell: 'powershell.exe' }); } L194: catch { child = spawn(command, { cwd, windowsHide: true, shell: true }); }

High

Shell

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Lines 172-212javascript

172 const timeout = Math.min(Number(timeoutMs) || 60000, 300000);

173 return new Promise((resolve) => {

174 let child;

175 try {

176

177 if (process.platform === 'win32') {

178 const bashCandidates = [

179 'C:\\Program Files\\Git\\bin\\bash.exe',

180 'C:\\Program Files\\Git\\usr\\bin\\bash.exe',

181 'C:\\Program Files (x86)\\Git\\bin\\bash.exe',

182 ];

183 let bashPath = null;

184 try { for (const p of bashCandidates) { if (fs.existsSync(p)) { bashPath = p; break; } } } catch {}

185

186 if (!bashPath) {

187 try { require('child_process').execSync('where bash', { stdio: 'ignore', windowsHide: true }); bashPath = 'bash'; } catch {}

188 }

189 if (bashPath) {

190 child = spawn(command, { cwd, windowsHide: true, shell: bashPath });

191 } else {

192

193 try { require('child_process').execSync('where powershell', { stdio: 'ignore', windowsHide: true }); child = spawn(command, { cwd, windowsHide: true, shell: 'powershell.exe' }); }

194 catch { child = spawn(command, { cwd, windowsHide: true, shell: true }); }

High

Shell

Package source references shell execution.

lib/tools.jsView on unpkg · L192

195 }

196 } else {

197

198 let bashPath = null;

199 try {

200 if (fs.existsSync('/bin/bash')) bashPath = '/bin/bash';

201 else if (fs.existsSync('/usr/bin/bash')) bashPath = '/usr/bin/bash';

202 } catch {}

203 if (bashPath) child = spawn(command, { cwd, shell: bashPath });

204 else child = spawn(command, { cwd, shell: true });

205 }

206 } catch (e) {

207 return resolve({ success: false, error: e.message, exitCode: null, stdout: '', stderr: '' });

208 }

209 let stdout = ''; let stderr = ''; let timedOut = false; let settled = false;

210 const settle = (r) => { if (settled) return; settled = true; clearTimeout(timer); resolve(r); };

211 const killTree = () => {

212 timedOut = true;