izanagi-ai@3.3.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

izanagi-ai@3.3.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/scripts/verify-build.jsView file

1import { execSync } from 'child_process'; L2: import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/scripts/verify-build.jsView on unpkg · L1

dist/runtime/contracts/artifacts.jsView file

1/** L2: * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

dist/installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolveframeworkroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(projectagents)) { return projectagents; } return getpackagedir(); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs.existssync(destina

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/installer.jsView on unpkg

dist/scripts/build-clean.jsView file

15console.log('📦 Compilando TypeScript com tsc...'); L16: execSync('npx tsc', { cwd: rootDir, stdio: 'inherit' }); L17: console.log('\n\x1b[32m✔ Build limpo e concluído em dist/!\x1b[0m\n');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/build-clean.jsView on unpkg · L15

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 63694 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 5901 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.2.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.2.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Source & flagged code

7 flagged

dist/scripts/verify-build.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/scripts/verify-build.jsView on unpkg · L1

3import path from 'path';

4import { fileURLToPath, pathToFileURL } from 'url';

5const __filename = fileURLToPath(import.meta.url);

6const __dirname = path.dirname(__filename);

7const rootDir = path.resolve(__dirname, '..', '..');

8try {

9 console.log('\n\x1b[36m=== 🧪 Testando Instalação em Projeto Fictício ===\x1b[0m\n');

10 // 1. Garantir que o build está pronto

11 execSync('npm run build', { cwd: rootDir, stdio: 'inherit' });

12 // 2. Criar diretório sandbox de teste

13 const sandboxDir = path.join(rootDir, 'tmp-sandbox-test');

14 if (fs.existsSync(sandboxDir)) {

15 fs.rmSync(sandboxDir, { recursive: true, force: true });

16 }

17 fs.mkdirSync(sandboxDir, { recursive: true });

18 // 3. Executar instalador simulando projeto de usuário (instala todos os packs)

19 const installerPath = path.join(rootDir, 'dist', 'installer.js');

20 const installerUrl = pathToFileURL(installerPath).href;

21 const packIds = `['core','agents','skills','architecture','coding','database','devops','security','testing','memory','optimization','teaching']`;

dist/runtime/contracts/artifacts.jsView file

Lines 1-21javascript

1/**

2 * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

3 *

4 * Artefato inválido → INVALID → REPAIR → RE-EVALUATE.

5 * O validators.ts aplica os schemas sobre artefatos (string | objeto) e

6 * devolve issues estruturadas.

7 */

8import crypto from

dist/installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolveframeworkroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(projectagents)) { return projectagents; } return getpackagedir(); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs.existssync(destina

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/installer.jsView on unpkg

dist/scripts/build-clean.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import fs from 'fs';

3import path from 'path';

4import { fileURLToPath } from 'url';

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 63694 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 5901 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.2.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.2.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg