Loading npm security reports…

johns-harness@2026.9.19: Malicious npm security report (Block) | LPM Firewall

registry / johns-harness / 2026.9.19

johns-harness@2026.9.19

John's Harness: a production agent harness that runs autonomous coding agents as one cooperative swarm.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically overwrites files in foreign installed dependencies, rewrites mr-memory, and removes source maps. This changes an AI-agent runtime and its plugin configuration without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation, through postinstall.

Impact

A package install can silently alter third-party AI-agent code and configuration in the consumer installation.

Mechanism

Automatic dependency patching and installed-plugin mutation.

Attack narrative

On npm install, the postinstall script locates packages named by bundled snapshots and copies snapshot files over their installed versions. It then rewrites the installed mr-memory package, including source files and plugin-manifest handling, and deletes source maps from the installation. These unprompted changes affect foreign AI-agent dependencies and make the resulting installed code differ from the published dependencies.

AI rationale

The automatic lifecycle hook performs broad, unconsented mutation of foreign AI-agent dependencies and removes diagnostic artifacts. Version checks limit target selection but do not make the install-time overwrite safe or user-authorized.

Evidence

package.jsonscripts/postinstall.mjsdist/migrate-plugin-adapters.jsscripts/strip-sourcemaps.mjsnode_modules/@mariozechner/pi-coding-agent/**node_modules/mr-memory/**node_modules/**.map

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs a postinstall script automatically.
The postinstall resolves bundled dependency snapshots and copies their files into installed dependency directories.
It rewrites the installed mr-memory package and may rename or delete its plugin manifest.
It deletes source maps from the installed tree after patching.

Evidence against

Target versions are checked before the dependency files are overwritten, but this does not obtain user consent for the mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,018 file(s), 47.6 MB of source, external domains: 127.0.0.1, 192.168.1.100, accounts.google.com, ai-gateway.vercel.sh, aistudio.google.com, albumart.url, api.anthropic.com, api.botframework.com, api.cerebras.ai, api.chutes.ai, api.deepgram.com, api.elevenlabs.io, api.example.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kilo.ai, api.kimi.com, api.meta.ai, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.push.apple.com, api.sandbox.push.apple.com, api.synthetic.new, api.telegram.org, api.telnyx.com, api.together.xyz, api.twilio.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, api.z.ai, app.memoryrouter.ai, ark.ap-southeast.bytepluses.com, ark.cn-beijing.volces.com, auth.openai.com, autopush-cloudcode-pa.sandbox.googleapis.com, bedrock-runtime.us-east-1.amazonaws.com, bot-api.zaloplatforms.com, bot.zaloplatforms.com, brave.com, brew.sh

Oversized source lightweight scan

dist/compact-B247y5Qt.js3.36 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.elevenlabs.ioapi.openai.comapi.telegram.orgchatgpt.comdocs.openclaw.aiopenrouter.ai

dist/pi-embedded-C6ITuRXf.js3.69 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.elevenlabs.ioapi.openai.comchatgpt.comdocs.openclaw.ai

Source & flagged code

30 flagged

package.jsonView file

Lines 222-262json

222 "types": "./dist/plugin-sdk/zalo.d.ts",

223 "default": "./dist/plugin-sdk/zalo.js"

224 },

225 "./plugin-sdk/zalouser": {

226 "types": "./dist/plugin-sdk/zalouser.d.ts",

227 "default": "./dist/plugin-sdk/zalouser.js"

228 },

229 "./plugin-sdk/account-id": {

230 "types": "./dist/plugin-sdk/account-id.d.ts",

231 "default": "./dist/plugin-sdk/account-id.js"

232 },

233 "./plugin-sdk/keyed-async-queue": {

234 "types": "./dist/plugin-sdk/keyed-async-queue.d.ts",

235 "default": "./dist/plugin-sdk/keyed-async-queue.js"

236 },

237 "./cli-entry": "./johnness.mjs"

238 },

239 "scripts": {

240 "start": "node johnness.mjs",

241 "test": "node --test tests/*.test.mjs",

242 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L242

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L242

243 "prepack": "node scripts/postinstall.mjs 1>&2"

244 },

245 "dependencies": {

246 "@agentclientprotocol/sdk": "0.15.0",

247 "@aws-sdk/client-bedrock": "^3.1004.0",

248 "@buape/carbon": "0.0.0-beta-20260216184201",

249 "@clack/prompts": "^1.1.0",

250 "@discordjs/voice": "^0.19.0",

251 "@grammyjs/runner": "^2.0.3",

252 "@grammyjs/transformer-throttler": "^1.2.1",

253 "@homebridge/ciao": "^1.3.5",

254 "@line/bot-sdk": "^10.6.0",

255 "@lydell/node-pty": "1.2.0-beta.3",

256 "@mariozechner/pi-agent-core": "0.55.3",

257 "@mariozechner/pi-ai": "0.55.3",

258 "@mariozechner/pi-coding-agent": "0.55.3",

259 "@mariozechner/pi-tui": "0.55.3",

260 "@mozilla/readability": "^0.6.0",

261 "@sinclair/typebox": "0.34.48",

262 "@slack/bolt": "^4.6.0",

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

Lines 1-3javascript

1const e={common:{version:"版本",health:"健康狀況",ok:"正常",offline:"離線",connect:"連接",refresh:"刷新",enabled:"已啟用",disabled:"已禁用",na:"不適用",docs:"文檔",resources:"資源"},nav:{chat:"聊天"

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

Lines 1-28javascript

1import { B as isNodeRuntime, z as isBunRuntime } from "./globals-BM8hKFm0.js";

2import { oi as VERSION } from "./model-selection-L7RMwsG-.js";

3import { _ as resolveNodeSystemdServiceName, c as NODE_WINDOWS_TASK_SCRIPT_NAME, g

dist/update-cli-Cm_l3W29.jsView file

Lines 537-577javascript

537 }

538 }

539 const hints = inferUpdateFailureHints(result);

540 if (hints.length > 0) {

541 defaultRuntime.log

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname

dist/daemon-cli.jsView file

10import fs from "node:fs/promises"; L11: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L12: import { isDeepStrictEqual, promisify } from "node:util"; ... L20: import { z } from "zod"; L21: import net from "node:net"; L22: import { spinner } from "@clack/prompts"; ... L34: } L35: function resolveEffectiveHomeDir(env = process.env, homedir = os.homedir) { L36: const raw = resolveRawHomeDir(env, homedir); ... L410: consolePatched: false, L411: forceConsoleToStderr: false, L412: consoleTimestampPrefix: false,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L10

444const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L445: return createRequire ? createRequire(metaUrl) : null; L446: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L444

extensions/diffs/src/viewer-assets.tsView file

Lines 1-31typescript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import { fileURLToPath } from "node:url";

5export const

dist/reply-C5LKjXcC.jsView file

62import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-svh6aj3U.js"; L63: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L64: import { n as formatToolSummary, r as resolveToolDisplay } from "./tool-display-ILkHoY2-.js"; ... L113: import { n as isQueryStopWordToken, t as extractKeywords } from "./query-expansion-CjS-pLDf.js"; L114: import { a as maxAsk, d as normalizeExecSecurity$1, g as resolveExecApprovalsFromFile, h as resolveExecApprovals, i as loadExecApprovals, l as normalizeExecAsk$1, m as requiresExec... L115: import { _ as applyPathPrepend, a as canvasSnapshotTempPath, b as normalizePathPrepend,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin-sdk/telegram.js: baseUrl: z.string().min(1), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), message: params.copy?.sourceMessage ?? "Where is this API key stored?",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

17import { fileURLToPath } from "node:url"; L18: import { Agent, EnvHttpProxyAgent } from "undici"; L19: import { lookup } from "node:dns"; L20: import { lookup as lookup$1 } from "node:dns/promises"; ... L68: }; L69: const envToken = accountId === "default" ? normalizeDiscordToken(opts.envToken ?? process.env.DISCORD_BOT_TOKEN, "DISCORD_BOT_TOKEN") : void 0; L70: if (envToken) return { ... L177: }; L178: const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in constants; L179: const OPEN_READ_FLAGS = constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0); ... L282: } L283: function isPrivateNetworkAllowedByPolicy(policy) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

67Cross-file remote execution chain: dist/compact-B247y5Qt.js spawns dist/export-html/vendor/highlight.min.js; helper contains network access plus dynamic code execution. L67: import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-zUwRrpJh.js"; L68: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L69: import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s... ... L94: import { c as upsertChannelPairingRequest, f as listPairingChannels, i as readChannelAllowFromStore, l as readJsonFileWithF

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

21Trigger-reachable chain: manifest.exports -> dist/plugin-sdk/index.js L21: import { a as openWritableFileWithinRoot, i as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-edcds3oU.js"; L22: import { a as isBlockedHostnameOrIp, i as isBlockedHostname, o as isPrivateIpAddress, t as SsrFBlockedError } from "./ssrf-D5Fmnfel.js"; L23: import { t as fetchWithSsrFGuard } from "./fetch-guard-xQKSiLEQ.js"; ... L65: import { pipeline } from "node:stream/promises"; L66: import { request } from "node:https"; L67: import { Readable, Transform } from "node:stream"; ... L84: success: true, L85: data: void 0 L86: }; ... L702: if (source === "env") { L703: const envVarRaw = await params.prompter.text({ L704: message: params.copy?.envVarMessage ?? "Environment variable name",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

9Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/restart-BzjDMmkD.js L9: import path from "node:path"; L10: import { spawn, spawnSync } from "node:child_process"; L11: import { randomUUID } from "node:crypto"; ... L26: const graceMs = normalizeGraceMs(opts?.graceMs); L27: if (process.platform === "win32") { L28: killProcessTreeWindows(pid, graceMs); ... L125: /** L126: * Parse johnness gateway PIDs from lsof -Fpc stdout. L127: * Pure function — no I/O. Excludes the current process. ... L253: * Blocks until the port is confirmed free (or the poll budget expires) so L254: * the supervisor (systemd / launchctl) does not race a zombie process for L255: * the port and enter an EADDRINUSE restart loop.

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = johns-harness@2026.9.18 matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.18 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/control-ui/assets/zh-TW-cW5xB87I.jsView on unpkg · L1

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts

High

Child Process

Package source references child process execution.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts ... L88: const { execFileSync } = await import("node:child_process"); L89: const cmd = process.platform === "win32" ? "where" : "which"; L90: try { ... L95: } catch { L96: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh"); L97: throw new Error("Node not found in PATH. Install Node 22+."); ... L229: addNonEmptyDir(dirs, env?.PNPM_HOME); L230: addNonEmptyDir(dirs, appendSubdir(env?.NPM_CONFIG_PREFIX, "bin")); L231: addNonEmptyDir(dirs, appendSubdir(env?.BUN_INSTALL, "bin"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

dist/update-cli-Cm_l3W29.jsView file

557} L558: /** Validates a string is safe for embedding in a batch (cmd.exe) script. */ L559: function isBatchSafe(value) {

High

Shell

Package source references shell execution.

dist/update-cli-Cm_l3W29.jsView on unpkg · L557

156import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-d2BV_F6m.js"; L157: import { spawn, spawnSync } from "node:child_process"; L158: import os from "node:os"; ... L172: } L173: const JOHNNESS_REPO_URL = "https://github.com/openclaw/openclaw.git"; L174: const MAX_LOG_CHARS = 8e3; ... L213: function resolveGitInstallDir() { L214: const override = process.env.JOHNNESS_GIT_DIR?.trim(); L215: if (override) return path.resolve(override); ... L218: function resolveDefaultGitDir() { L219: return resolveStateDir(process.env, os.homedir); L220: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cm_l3W29.jsView on unpkg · L156

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

High

Eval

Package source references dynamic code evaluation.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/daemon-cli.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L10

444const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L445: return createRequire ? createRequire(metaUrl) : null; L446: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L444

extensions/diffs/src/viewer-assets.tsView file

11export type ServedViewerAsset = { L12: body: string | Buffer; L13: contentType: string;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/diffs/src/viewer-assets.tsView on unpkg · L11

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Findings

5 Critical12 High15 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/reply-C5LKjXcC.js

CriticalCredential Exfiltrationdist/reply-C5LKjXcC.js

CriticalRemote Asset Decode Executedist/reply-C5LKjXcC.js

CriticalTrigger Reachable Dangerous Capabilitydist/plugin-sdk/index.js

CriticalPrevious Version Dangerous Deltadist/plugin-sdk/dispatch-BP0viZiL.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/daemon-install-plan.shared-6BfiTrDp.js

HighShelldist/update-cli-Cm_l3W29.js

HighEvalnode_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom-engine.ts

HighCredential Redirect Persistencedist/plugin-sdk/telegram.js

HighCommand Output Exfiltrationdist/daemon-cli.js

HighSandbox Evasion Gated Capabilitydist/daemon-install-plan.shared-6BfiTrDp.js

HighCloud Metadata Accessdist/shared-Cg8lr3fh.js

HighCross File Remote Execution Contextdist/compact-B247y5Qt.js

HighTrigger Reachable Credential Exfiltrationdist/reply-C5LKjXcC.js

HighTrigger Reachable Persistencedist/restart-BzjDMmkD.js

HighSemantic Analysis Limiteddist/logger-Bj0Xl6pn.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/control-ui/assets/zh-TW-cW5xB87I.js

MediumDynamic Requiredist/daemon-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/update-cli-Cm_l3W29.js

MediumShips Wasm Modulenode_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py

MediumOversized Source Fileextensions/diffs/assets/viewer-runtime.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/control-ui/assets/es-DHtyqUQZ.js

MediumSecret Patterndist/control-ui/assets/zh-CN-BgJ8_lE3.js

MediumSecret Patterndist/control-ui/assets/index-CvRIBzDR.js

MediumSecret Patterndist/control-ui/assets/pt-BR-D2dJb9G8.js

MediumSecret Patterndist/control-ui/assets/de-DuUYLvt1.js

LowScripts Present

LowWeak Cryptoextensions/diffs/src/viewer-assets.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

30 flagged

package.jsonView file

Lines 222-262json

222 "types": "./dist/plugin-sdk/zalo.d.ts",

223 "default": "./dist/plugin-sdk/zalo.js"

224 },

225 "./plugin-sdk/zalouser": {

226 "types": "./dist/plugin-sdk/zalouser.d.ts",

227 "default": "./dist/plugin-sdk/zalouser.js"

228 },

229 "./plugin-sdk/account-id": {

230 "types": "./dist/plugin-sdk/account-id.d.ts",

231 "default": "./dist/plugin-sdk/account-id.js"

232 },

233 "./plugin-sdk/keyed-async-queue": {

234 "types": "./dist/plugin-sdk/keyed-async-queue.d.ts",

235 "default": "./dist/plugin-sdk/keyed-async-queue.js"

236 },

237 "./cli-entry": "./johnness.mjs"

238 },

239 "scripts": {

240 "start": "node johnness.mjs",

241 "test": "node --test tests/*.test.mjs",

242 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L242

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L242

243 "prepack": "node scripts/postinstall.mjs 1>&2"

244 },

245 "dependencies": {

246 "@agentclientprotocol/sdk": "0.15.0",

247 "@aws-sdk/client-bedrock": "^3.1004.0",

248 "@buape/carbon": "0.0.0-beta-20260216184201",

249 "@clack/prompts": "^1.1.0",

250 "@discordjs/voice": "^0.19.0",

251 "@grammyjs/runner": "^2.0.3",

252 "@grammyjs/transformer-throttler": "^1.2.1",

253 "@homebridge/ciao": "^1.3.5",

254 "@line/bot-sdk": "^10.6.0",

255 "@lydell/node-pty": "1.2.0-beta.3",

256 "@mariozechner/pi-agent-core": "0.55.3",

257 "@mariozechner/pi-ai": "0.55.3",

258 "@mariozechner/pi-coding-agent": "0.55.3",

259 "@mariozechner/pi-tui": "0.55.3",

260 "@mozilla/readability": "^0.6.0",

261 "@sinclair/typebox": "0.34.48",

262 "@slack/bolt": "^4.6.0",

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

Lines 1-3javascript

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

Lines 1-28javascript

1import { B as isNodeRuntime, z as isBunRuntime } from "./globals-BM8hKFm0.js";

2import { oi as VERSION } from "./model-selection-L7RMwsG-.js";

3import { _ as resolveNodeSystemdServiceName, c as NODE_WINDOWS_TASK_SCRIPT_NAME, g

dist/update-cli-Cm_l3W29.jsView file

Lines 537-577javascript

537 }

538 }

539 const hints = inferUpdateFailureHints(result);

540 if (hints.length > 0) {

541 defaultRuntime.log

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname

dist/daemon-cli.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L10

444const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L445: return createRequire ? createRequire(metaUrl) : null; L446: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L444

extensions/diffs/src/viewer-assets.tsView file

Lines 1-31typescript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import { fileURLToPath } from "node:url";

5export const

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

johns-harness@2026.9.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code