iclavue@10.8.1: Suspicious npm security report (Warn)

Loading npm security reports…

iclavue@10.8.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 54-94json

54 "url": "git+https://github.com/mycode699/clavue.git"

55 },

56 "publishConfig": {

57 "access": "public"

58 },

59 "bundleDependencies": [

60 "@anthropic-ai/sandbox-runtime",

61 "@opentelemetry/api",

62 "@opentelemetry/api-logs",

63 "@opentelemetry/core",

64 "@opentelemetry/resources",

65 "@opentelemetry/sdk-logs",

66 "@opentelemetry/sdk-metrics",

67 "@opentelemetry/sdk-trace-base",

68 "@opentelemetry/semantic-conventions",

69 "ajv",

70 "lru-cache",

71 "qrcode"

72 ],

73 "scripts": {

74 "postinstall": "node scripts/postinstall-pager.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L74

75 "prepublishOnly": "npm run check:pager-native-publish",

76 "build": "npm run check:release && npm pack --dry-run",

77 "build:knowledge": "node scripts/build-project-knowledge.mjs",

78 "vendor:ripgrep": "node scripts/vendor-ripgrep.mjs",

79 "check": "npm run check:quick",

80 "check:fast": "npm run check:types && npm run check:source-purity && npm run check:boundaries && npm run check:architecture-budget && npm run check:ui-protocol-registry && npm run test:fast && npm run check:startup",

81 "check:quick": "npm run validate:repo && npm run check:test-hygiene && npm run check:source-purity && npm run check:boundaries && npm run check:ui-action-allowlist && npm run check:architecture-budget && npm run check:types && npm test && npm run check:test-hygiene && npm run check:pager-ui && npm run check:eval-baseline && npm run test:system-contract",

82 "check:release": "npm run vendor:ripgrep && npm run validate:repo && npm run check:test-hygiene && npm run verify:dist-clean && npm run verify:dist && npm run verify:source-build && npm run check:source-purity && npm run check:boundaries && npm run check:architecture-budget && npm run check:types && npm test && npm run check:test-hygiene && npm run check:pager-release && npm run check:flywheel",

83 "check:hygiene": "npm run validate:repo",

84 "check:test-hygiene": "node scripts/check-test-tmp-hygiene.mjs",

85 "test:clean-tmp": "node scripts/clean-test-tmp.mjs",

86 "check:source-purity": "node scripts/check-source-purity.mjs",

87 "check:boundaries": "node scripts/check-architecture-boundaries.mjs",

88 "check:commits": "node scripts/check-commit-message.mjs --range HEAD~1..HEAD",

89 "check:architecture-budget": "node scripts/check-architecture-budget.mjs",

90 "check:knip": "node scripts/check-knip-baseline.mjs",

91 "check:types": "node scripts/check-types.mjs",

92 "verify:source-build": "node scripts/build-plugin.mjs",

93 "verify:dist-clean": "node scripts/verify-dist-clean.mjs",

94 "rebuild:dist": "CLAVUE_BUILD_TARGET=dist node scripts/build-plugin.mjs && node scripts/build-pager-release.mjs",

dist/provider-command.jsView file

Lines 907-947javascript

907 }

908 }

909 }

910

911 const savedProfile = saveProviderProfile(

912 createSavableCurrentProfile(currentProfile, targetName),

913 {

914 activate:

dist/native/clavue-pager-win32-x64.exeView file

•path = dist/native/clavue-pager-win32-x64.exe kind = native_binary sizeBytes = 4507278 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-win32-x64.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2379174 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17254445 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/provider-command.jsView file

927L928: const importMatch = trimmedArgs.match(/^import(?:\s+(.+))?$/i) L929: if (importMatch) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/provider-command.jsView on unpkg · L927

dist/native/clavue-pager-win32-x64.exeView file

•path = dist/native/clavue-pager-win32-x64.exe kind = native_binary sizeBytes = 4507278 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-win32-x64.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2379174 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17254445 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 54-94json

54 "url": "git+https://github.com/mycode699/clavue.git"

55 },

56 "publishConfig": {

57 "access": "public"

58 },

59 "bundleDependencies": [

60 "@anthropic-ai/sandbox-runtime",

61 "@opentelemetry/api",

62 "@opentelemetry/api-logs",

63 "@opentelemetry/core",

64 "@opentelemetry/resources",

65 "@opentelemetry/sdk-logs",

66 "@opentelemetry/sdk-metrics",

67 "@opentelemetry/sdk-trace-base",

68 "@opentelemetry/semantic-conventions",

69 "ajv",

70 "lru-cache",

71 "qrcode"

72 ],

73 "scripts": {

74 "postinstall": "node scripts/postinstall-pager.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L74

75 "prepublishOnly": "npm run check:pager-native-publish",

76 "build": "npm run check:release && npm pack --dry-run",

77 "build:knowledge": "node scripts/build-project-knowledge.mjs",

78 "vendor:ripgrep": "node scripts/vendor-ripgrep.mjs",

79 "check": "npm run check:quick",

83 "check:hygiene": "npm run validate:repo",

84 "check:test-hygiene": "node scripts/check-test-tmp-hygiene.mjs",

85 "test:clean-tmp": "node scripts/clean-test-tmp.mjs",

86 "check:source-purity": "node scripts/check-source-purity.mjs",

87 "check:boundaries": "node scripts/check-architecture-boundaries.mjs",

88 "check:commits": "node scripts/check-commit-message.mjs --range HEAD~1..HEAD",

89 "check:architecture-budget": "node scripts/check-architecture-budget.mjs",

90 "check:knip": "node scripts/check-knip-baseline.mjs",

91 "check:types": "node scripts/check-types.mjs",

92 "verify:source-build": "node scripts/build-plugin.mjs",

93 "verify:dist-clean": "node scripts/verify-dist-clean.mjs",

94 "rebuild:dist": "CLAVUE_BUILD_TARGET=dist node scripts/build-plugin.mjs && node scripts/build-pager-release.mjs",

dist/provider-command.jsView file

Lines 907-947javascript

907 }

908 }

909 }

910

911 const savedProfile = saveProviderProfile(

912 createSavableCurrentProfile(currentProfile, targetName),

913 {

914 activate:

dist/native/clavue-pager-win32-x64.exeView file

•path = dist/native/clavue-pager-win32-x64.exe kind = native_binary sizeBytes = 4507278 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-win32-x64.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2379174 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17254445 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

iclavue@10.8.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code