factory-factory: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

factory-factory: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/backend/trpc/project.router.test.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/src/backend/trpc/project.router.test.jsView on unpkg · L1

dist/src/backend/lib/shell.jsView file

4import { LIB_LIMITS } from './constants.js'; L5: const execAsync = promisify(exec); L6: export function escapeShellArg(arg) {

High

Shell

Package source references shell execution.

dist/src/backend/lib/shell.jsView on unpkg · L4

dist/src/backend/services/session/service/store/session-transcript.jsView file

1import { createHash } from 'node:crypto'; L2: import { shouldPersistAgentMessage, [redacted], } from '../../../../../shared/acp-protocol/index.js';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/backend/services/session/service/store/session-transcript.jsView on unpkg · L1

dist/src/backend/services/session/service/acp/child-workspace-mcp-server.test.jsView file

29} L30: const child = spawn(TSX_BIN, [fileURLToPath(new URL('./child-workspace-mcp-server.ts', import.meta.url))], { L31: env: { L32: ...process.env, L33: FF_CHILD_WORKSPACE_MCP: '1', ... L35: FF_WORKSPACE_PARENT_ID: '', L36: FF_API_BASE_URL: `http://127.0.0.1:${address.port}`, L37: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/backend/services/session/service/acp/child-workspace-mcp-server.test.jsView on unpkg · L29

dist/src/cli/index.jsView file

383console.log(chalk.blue(`Opening Prisma Studio for ${effectivePath}...`)); L384: const studio = spawn('npx', ['prisma', 'studio'], { L385: cwd: PROJECT_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/index.jsView on unpkg · L383

dist/client/sounds/workspace-complete.mp3View file

•path = dist/client/sounds/workspace-complete.mp3 kind = high_entropy_blob sizeBytes = 48946 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/workspace-complete.mp3View on unpkg

dist/client/assets/index-DEKuJM5_.jsView file

•path = dist/client/assets/index-DEKuJM5_.js kind = oversized_source_file sizeBytes = 3285192 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/client/assets/index-DEKuJM5_.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 64-104json

64 "check:biome-ignores": "node scripts/check-biome-ignores.mjs",

65 "check:service-registry": "tsx scripts/check-service-registry.ts",

66 "check:prisma-generated": "node scripts/check-prisma-generated-drift.mjs",

67 "check:prisma-schema": "pnpm db:generate && pnpm check:service-registry && pnpm typecheck",

68 "check:ownership": "node scripts/check-service-accessor-boundaries.mjs && node scripts/check-single-writer.mjs && pnpm check:service-registry",

69 "check:codex-schema": "node scripts/check-codex-schema-drift.mjs",

70 "check:codex-schema:update": "node scripts/check-codex-schema-drift.mjs --update",

71 "codex:schema:generate": "node scripts/generate-codex-app-server-schemas.mjs",

72 "check:fix": "biome check --write .",

73 "typecheck": "pnpm --filter @factory-factory/core build && tsc --noEmit",

74 "db:migrate": "prisma migrate dev",

75 "db:generate": "prisma generate",

76 "db:studio": "prisma studio",

77 "storybook": "pnpm --filter @factory-factory/core build && storybook dev -p 6006",

78 "dev:electron": "node scripts/ensure-native-modules.mjs electron && tsc -p tsconfig.electron.json && concurrently \"pnpm dev:backend\" \"pnpm dev:frontend\" \"wait-on http://localhost:5173 && VITE_DEV_SERVER_URL=http://localhost:5173 electron .\"",

79 "dev:backend": "pnpm --filter @factory-factory/core build && BACKEND_PORT=3001 tsx watch src/backend/index.ts",

80 "dev:frontend": "BACKEND_URL=http://localhost:3001 vite",

81 "build:electron": "pnpm build && pnpm exec tsc -p tsconfig.electron.json && node scripts/ensure-native-modules.mjs electron && electron-builder",

82 "rebuild:electron": "electron-rebuild -f -m . -o better-sqlite3,node-pty",

83 "start:electron": "electron .",

84 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L84

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L84

85 "prepare": "husky",

86 "deps:check": "depcruise src electron --config .dependency-cruiser.cjs",

87 "knip": "knip --include files,dependencies,unlisted"

88 },

89 "dependencies": {

90 "@agentclientprotocol/claude-agent-acp": "^0.55.0",

91 "@agentclientprotocol/sdk": "0.15.0",

92 "@linear/sdk": "^76.0.0",

93 "@phosphor-icons/react": "^2.1.10",

94 "@prisma/adapter-better-sqlite3": "7.7.0",

95 "@prisma/client": "7.7.0",

96 "@radix-ui/react-accordion": "^1.2.12",

97 "@radix-ui/react-alert-dialog": "^1.1.15",

98 "@radix-ui/react-aspect-ratio": "^1.1.8",

99 "@radix-ui/react-avatar": "^1.1.11",

100 "@radix-ui/react-checkbox": "^1.3.3",

101 "@radix-ui/react-collapsible": "^1.1.12",

102 "@radix-ui/react-context-menu": "^2.2.16",

103 "@radix-ui/react-dialog": "^1.1.15",

104 "@radix-ui/react-dropdown-menu": "^2.1.16",

dist/src/backend/trpc/project.router.test.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/src/backend/trpc/project.router.test.jsView on unpkg · L1

3import { tmpdir } from 'node:os';

dist/src/backend/lib/shell.jsView file

Lines 1-24javascript

1import { exec, spawn } from 'node:child_process';

2import { StringDecoder } from 'node:string_decoder';

3import { promisify } from 'node:util';

4import { LIB_LIMITS } from './constants.js';

dist/src/backend/services/session/service/store/session-transcript.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { shouldPersistAgentMessage, shouldSuppressDuplicateResultMessage, } from '../../../../../shared/acp-protocol/index.js';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/backend/services/session/service/store/session-transcript.jsView on unpkg · L1

3export function

dist/src/backend/services/session/service/acp/child-workspace-mcp-server.test.jsView file

Lines 9-49javascript

9const TSX_BIN = join(REPO_ROOT, 'node_modules', '.bin', process.platform === 'win32' ? 'tsx.cmd' : 'tsx');

dist/src/cli/index.jsView file

Lines 363-403javascript

363 try {

364 const migrationsPath = join(PROJECT_ROOT, 'prisma', 'migrations');

365 runDbMigrations({

366 databasePath: effectivePath,

367

dist/client/sounds/workspace-complete.mp3View file

•path = dist/client/sounds/workspace-complete.mp3 kind = high_entropy_blob sizeBytes = 48946 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sounds/workspace-complete.mp3View on unpkg

dist/client/assets/index-DEKuJM5_.jsView file

•path = dist/client/assets/index-DEKuJM5_.js kind = oversized_source_file sizeBytes = 3285192 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/client/assets/index-DEKuJM5_.jsView on unpkg