jefrichat-mcp@0.6.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

jefrichat-mcp@0.6.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/index.jsView file

25329contains invisible/control Unicode U+2060 (word joiner) const UNI = /[  <U+2060>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L25329

•Trigger-reachable chain: manifest.bin -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

25285import np from "node:path"; L25286: import cp from "node:child_process"; L25287: import os2 from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L25285

25621L25622: \u2022 Windows (PowerShell \u2014 avoids the curl/schannel TLS error): L25623: ${psCmd}

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L25621

26339const ps = `Add-Type -AssemblyName System.Windows.Forms;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.BalloonTipTitle='${esc2(t... L26340: cp2.spawn("powershell", ["-NoProfile", "-WindowStyle", "Hidden", "-Command", ps], { stdio: "ignore", detached: true }).unref(); L26341: } else { ... L26348: // src/index.ts L26349: var SERVER = process.env.ACP_SERVER ?? "http://localhost:4000"; L26350: var TOKEN = process.env.ACP_TOKEN;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L26339

2952sourceCode = this.opts.code.process(sourceCode, sch); L2953: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2954: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L2952

dist/http.jsView file

•path = dist/http.js kind = oversized_source_file sizeBytes = 2155376 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/http.jsView on unpkg

•path = dist/http.js kind = oversized_cli_entrypoint sizeBytes = 2155376 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/http.jsView on unpkg

Source & flagged code

8 flagged

dist/index.jsView file

25329contains invisible/control Unicode U+2060 (word joiner) const UNI = /[  <U+2060>]/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L25329

•Trigger-reachable chain: manifest.bin -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

25285import np from "node:path"; L25286: import cp from "node:child_process"; L25287: import os2 from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L25285

25621L25622: \u2022 Windows (PowerShell \u2014 avoids the curl/schannel TLS error): L25623: ${psCmd}

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L25621

26339const ps = `Add-Type -AssemblyName System.Windows.Forms;$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::Information;$n.BalloonTipTitle='${esc2(t... L26340: cp2.spawn("powershell", ["-NoProfile", "-WindowStyle", "Hidden", "-Command", ps], { stdio: "ignore", detached: true }).unref(); L26341: } else { ... L26348: // src/index.ts L26349: var SERVER = process.env.ACP_SERVER ?? "http://localhost:4000"; L26350: var TOKEN = process.env.ACP_TOKEN;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L26339

2952sourceCode = this.opts.code.process(sourceCode, sch); L2953: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2954: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L2952

dist/http.jsView file

•path = dist/http.js kind = oversized_source_file sizeBytes = 2155376 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/http.jsView on unpkg

•path = dist/http.js kind = oversized_cli_entrypoint sizeBytes = 2155376 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/http.jsView on unpkg