irises-darwin-x64@1.0.41: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

irises-darwin-x64@1.0.41: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

extensions/remote-exec/dist/index.mjsView file

11124patternName = private_key_rsa severity = critical line = 11124 matchedText = const ke...--\r

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/remote-exec/dist/index.mjsView on unpkg · L11124

11124patternName = private_key_rsa severity = critical line = 11124 matchedText = const ke...--\r

Critical

Secret Pattern

RSA private key in extensions/remote-exec/dist/index.mjs

extensions/remote-exec/dist/index.mjsView on unpkg · L11124

13838patternName = private_key_openssh severity = critical line = 13838 matchedText = const re...-$/;

Critical

Secret Pattern

OpenSSH private key in extensions/remote-exec/dist/index.mjs

extensions/remote-exec/dist/index.mjsView on unpkg · L13838

25649patternName = private_key_openssh severity = critical line = 25649 matchedText = let priv...----

Critical

Secret Pattern

OpenSSH private key in extensions/remote-exec/dist/index.mjs

extensions/remote-exec/dist/index.mjsView on unpkg · L25649

web-ui/dist/assets/vendor-highlight-DXL0APe2.jsView file

1import{g as ot}from"./vendor-xterm-CUbQ1_3S.js";var $e,an;function ct(){if(an)return $e;an=1;function e(n){return n instanceof Map?n.clear=n.delete=n.set=function(){throw new Error... L2: https://github.com/highlightjs/highlight.js/issues/2277`),W=i,U=p),I===void 0&&(I=!0);const ie={code:U,language:W};Re("before:highlight",ie);const _e=ie.result?ie.result:Se(ie.lang...

High

Child Process

Package source references child process execution.

web-ui/dist/assets/vendor-highlight-DXL0APe2.jsView on unpkg · L1

extensions/ide/dist/index.mjsView file

26501return { L26502: command: getEnvValue(env, "ComSpec") || "cmd.exe", L26503: args: ["/d", "/v:off", "/s", "/c", `"${tokens.join(" ")}"`],

High

Shell

Package source references shell execution.

extensions/ide/dist/index.mjsView on unpkg · L26501

bin/opentui/parser.worker.jsView file

2355var func = `(${args}) => { ${body} };`; L2356: ASM_CONSTS[start] = eval(func); L2357: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/opentui/parser.worker.jsView on unpkg · L2355

extensions/web/dist/index.mjsView file

12907const id = `term-${nextId++}`; L12908: const reqUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`); L12909: const initialCols = Math.max(1, parseInt(reqUrl.searchParams.get("cols") ?? "", 10) || 120); L12910: const initialRows = Math.max(1, parseInt(reqUrl.searchParams.get("rows") ?? "", 10) || 30); L12911: const tuiEnv = { ...process.env, IRIS_PLATFORM: "console" }; L12912: let spawnCmd; ... L12921: const whereCmd = os3.platform() === "win32" ? "where bun.exe" : "which bun"; L12922: const resolved = execSync(whereCmd, { encoding: "utf-8", timeout: 5000 }).trim().split(/\r?\n/)[0]; L12923: if (resolved && fs7.existsSync(resolved)) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

extensions/web/dist/index.mjsView on unpkg · L12907

2443Cross-file remote execution chain: extensions/web/dist/index.mjs spawns extensions/ide/dist/index.mjs; helper contains network access plus dynamic code execution. L2443: if (typeof node_buffer.Buffer === "function") { L2444: return node_buffer.Buffer.from(src, "base64"); L2445: } else if (typeof atob === "function") { ... L4902: yield* this.next(token); L4903: yield* this.end(forceDoc, endOffset); L4904: } L4905: *next(token) { L4906: if (node_process.env.LOG_STREAM) L4907: console.dir(token, { depth: null }); ... L7013: kStatusCode: Symbol("status-code"), L7014: kWebSocket: Symbol("websocket"), L7015: NOOP: () => {}

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

extensions/web/dist/index.mjsView on unpkg · L2443

bin/irisView file

•path = bin/iris kind = native_binary sizeBytes = 75598400 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/irisView on unpkg

bin/opentui/tree-sitter-3jzf13jk.wasmView file

•path = bin/opentui/tree-sitter-3jzf13jk.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/opentui/tree-sitter-3jzf13jk.wasmView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 20918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

web-ui/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-ui/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-ui/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

extensions/multimodal/dist/index.mjsView file

•path = [redacted].mjs kind = oversized_source_file sizeBytes = 3466458 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

extensions/multimodal/dist/index.mjsView on unpkg

Lines 12887-12927javascript

12887var import_websocket = __toESM(require_websocket(), 1);

12888var import_websocket_server = __toESM(require_websocket_server(), 1);

12889

12890// extensions/web/src/handlers/terminal.ts

12891var logger = createExtensionLogger("Terminal");

12892var pty = null;

12893try {

12894 pty = await import("node-pty");

12895} catch {

12896 logger.warn("node-pty 不可用，终端功能将被禁用");

12897}

12898function createTerminalHandler(isCompiledBinary = false, projectRoot = process.cwd()) {

12899 const sessions = new Map;

12900 const wss = new import_websocket_server.default({ noServer: true });

12901 let nextId = 1;

12902 wss.on("connection", (ws, req) => {

12903 if (!pty) {

12904 ws.close(1011, "node-pty 不可用");

12905 return;

12906 }

12907 const id = `term-${nextId++}`;

12908 const reqUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);

12909 const initialCols = Math.max(1, parseInt(reqUrl.searchParams.get("cols") ?? "", 10) || 120);

12910 const initialRows = Math.max(1, parseInt(reqUrl.searchParams.get("rows") ?? "", 10) || 30);

12911 const tuiEnv = { ...process.env, IRIS_PLATFORM: "console" };

12912 let spawnCmd;

12913 let spawnArgs;

12914 if (isCompiledBinary) {

12915 spawnCmd = process.execPath;

12916 spawnArgs = [];

12917 } else {

12918 const entryFile = path11.join(projectRoot, "src", "index.ts");

12919 let bunPath = null;

12920 try {

12921 const whereCmd = os3.platform() === "win32" ? "where bun.exe" : "which bun";

12922 const resolved = execSync(whereCmd, { encoding: "utf-8", timeout: 5000 }).trim().split(/\r?\n/)[0];

12923 if (resolved && fs7.existsSync(resolved)) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

extensions/web/dist/index.mjsView on unpkg · L12907

12924 bunPath = resolved;

12925 }

12926 } catch {}

12927 if (!bunPath) {