johns-harness@2026.9.40: Suspicious npm security report (Warn)

Loading npm security reports…

johns-harness@2026.9.40: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

41 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/control-ui/assets/zh-TW-cW5xB87I.jsView on unpkg · L1

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts

High

Child Process

Package source references child process execution.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts ... L88: const { execFileSync } = await import("node:child_process"); L89: const cmd = process.platform === "win32" ? "where" : "which"; L90: try { ... L95: } catch { L96: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh"); L97: throw new Error("Node not found in PATH. Install Node 22+."); ... L229: addNonEmptyDir(dirs, env?.PNPM_HOME); L230: addNonEmptyDir(dirs, appendSubdir(env?.NPM_CONFIG_PREFIX, "bin")); L231: addNonEmptyDir(dirs, appendSubdir(env?.BUN_INSTALL, "bin"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

dist/daemon-cli.jsView file

3199function escapeForCmdExe(arg) { L3200: if (WINDOWS_UNSAFE_CMD_CHARS_RE.test(arg)) throw new Error(`Unsafe Windows cmd.exe argument detected: ${JSON.stringify(arg)}. Pass an explicit shell-wrapper argv at the call site i... L3201: if (!arg.includes(" ") && !arg.includes("\"")) return arg;

High

Shell

Package source references shell execution.

dist/daemon-cli.jsView on unpkg · L3199

11import fs from "node:fs/promises"; L12: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L13: import { isDeepStrictEqual, promisify } from "node:util"; ... L21: import { z } from "zod"; L22: import net from "node:net"; L23: import { spinner } from "@clack/prompts"; ... L35: } L36: function resolveEffectiveHomeDir(env = process.env, homedir = os.homedir) { L37: const raw = resolveRawHomeDir(env, homedir); ... L411: consolePatched: false, L412: forceConsoleToStderr: false, L413: consoleTimestampPrefix: false,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L11

445const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L446: return createRequire ? createRequire(metaUrl) : null; L447: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L445

scripts/check-models-master.mjsView file

36const end = src.indexOf("const DEFAULT_MODEL_COST = {", start); L37: const table = new Function(`${src.slice(start, end)}; return DEFAULT_MODEL_ALIASES;`)(); L38: if (sorted(table) !== aliases) problems.push(`${rel}: alias table differs from models/models.json`);

High

Eval

Package source references dynamic code evaluation.

scripts/check-models-master.mjsView on unpkg · L36

extensions/diffs/src/viewer-assets.tsView file

11export type ServedViewerAsset = { L12: body: string | Buffer; L13: contentType: string;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/diffs/src/viewer-assets.tsView on unpkg · L11

dist/update-cli-Cm_l3W29.jsView file

157import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-d2BV_F6m.js"; L158: import { spawn, spawnSync } from "node:child_process"; L159: import os from "node:os"; ... L173: } L174: const JOHNNESS_REPO_URL = "https://github.com/openclaw/openclaw.git"; L175: const MAX_LOG_CHARS = 8e3; ... L214: function resolveGitInstallDir() { L215: const override = process.env.JOHNNESS_GIT_DIR?.trim(); L216: if (override) return path.resolve(override); ... L219: function resolveDefaultGitDir() { L220: return resolveStateDir(process.env, os.homedir); L221: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cm_l3W29.jsView on unpkg · L157

dist/reply-C5LKjXcC.jsView file

62import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-svh6aj3U.js"; L63: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L64: import { n as formatToolSummary, r as resolveToolDisplay } from "./tool-display-ILkHoY2-.js"; ... L113: import { n as isQueryStopWordToken, t as extractKeywords } from "./query-expansion-CjS-pLDf.js"; L114: import { a as maxAsk, d as normalizeExecSecurity$1, g as resolveExecApprovalsFromFile, h as resolveExecApprovals, i as loadExecApprovals, l as normalizeExecAsk$1, m as requiresExec... L115: import { _ as applyPathPrepend, a as canvasSnapshotTempPath, b as normalizePathPrepend,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin-sdk/telegram.js: baseUrl: z.string().min(1), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), message: params.copy?.sourceMessage ?? "Where is this API key stored?",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

17import { fileURLToPath } from "node:url"; L18: import { Agent, EnvHttpProxyAgent } from "undici"; L19: import { lookup } from "node:dns"; L20: import { lookup as lookup$1 } from "node:dns/promises"; ... L68: }; L69: const envToken = accountId === "default" ? normalizeDiscordToken(opts.envToken ?? process.env.DISCORD_BOT_TOKEN, "DISCORD_BOT_TOKEN") : void 0; L70: if (envToken) return { ... L177: }; L178: const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in constants; L179: const OPEN_READ_FLAGS = constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0); ... L282: } L283: function isPrivateNetworkAllowedByPolicy(policy) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

67Cross-file remote execution chain: dist/compact-B247y5Qt.js spawns dist/export-html/vendor/highlight.min.js; helper contains network access plus dynamic code execution. L67: import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-zUwRrpJh.js"; L68: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L69: import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s... ... L94: import { c as upsertChannelPairingRequest, f as listPairingChannels, i as readChannelAllowFromStore, l as readJsonFileWithF

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

21Trigger-reachable chain: manifest.exports -> dist/plugin-sdk/index.js L21: import { a as openWritableFileWithinRoot, i as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-edcds3oU.js"; L22: import { a as isBlockedHostnameOrIp, i as isBlockedHostname, o as isPrivateIpAddress, t as SsrFBlockedError } from "./ssrf-D5Fmnfel.js"; L23: import { t as fetchWithSsrFGuard } from "./fetch-guard-xQKSiLEQ.js"; ... L65: import { pipeline } from "node:stream/promises"; L66: import { request } from "node:https"; L67: import { Readable, Transform } from "node:stream"; ... L84: success: true, L85: data: void 0 L86: }; ... L702: if (source === "env") { L703: const envVarRaw = await params.prompter.text({ L704: message: params.copy?.envVarMessage ?? "Environment variable name",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

10Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/restart-BzjDMmkD.js L10: import path from "node:path"; L11: import { spawn, spawnSync } from "node:child_process"; L12: import { randomUUID } from "node:crypto"; ... L27: const graceMs = normalizeGraceMs(opts?.graceMs); L28: if (process.platform === "win32") { L29: killProcessTreeWindows(pid, graceMs); ... L126: /** L127: * Parse johnness gateway PIDs from lsof -Fpc stdout. L128: * Pure function — no I/O. Excludes the current process. ... L254: * Blocks until the port is confirmed free (or the poll budget expires) so L255: * the supervisor (systemd / launchctl) does not race a zombie process for L256: * the port and enter an EADDRINUSE restart loop.

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L10

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/model-selection-L7RMwsG-.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/model-selection-L7RMwsG-.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/model-selection-L7RMwsG-.jsView on unpkg

dist/plugin-sdk/config-4Fgm-yEH.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/config-4Fgm-yEH.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-4Fgm-yEH.jsView on unpkg

dist/plugin-sdk/config-Di-lyCdh.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/config-Di-lyCdh.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-Di-lyCdh.jsView on unpkg

dist/plugin-sdk/discord.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/discord.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/model-auth-CX9cPHdC.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/model-auth-CX9cPHdC.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/model-auth-CX9cPHdC.jsView on unpkg

dist/plugin-sdk/bluebubbles.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/bluebubbles.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/bluebubbles.jsView on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/dispatch-BP0viZiL.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/plugin-sdk/dispatch-Cerq29sy.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/dispatch-Cerq29sy.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cerq29sy.jsView on unpkg

dist/plugin-sdk/dispatch-Cndjtt0g.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/dispatch-Cndjtt0g.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cndjtt0g.jsView on unpkg

dist/plugin-sdk/feishu.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/feishu.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/feishu.jsView on unpkg

dist/plugin-sdk/googlechat.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/googlechat.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/googlechat.jsView on unpkg

dist/plugin-sdk/imessage.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.34 matchedPath = dist/plugin-sdk/imessage.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/imessage.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Source & flagged code

41 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/control-ui/assets/zh-TW-cW5xB87I.jsView on unpkg · L1

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts

High

Child Process

Package source references child process execution.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

dist/daemon-cli.jsView file

High

Shell

Package source references shell execution.

dist/daemon-cli.jsView on unpkg · L3199

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L11

445const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L446: return createRequire ? createRequire(metaUrl) : null; L447: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L445

scripts/check-models-master.mjsView file

High

Eval

Package source references dynamic code evaluation.

scripts/check-models-master.mjsView on unpkg · L36

extensions/diffs/src/viewer-assets.tsView file

11export type ServedViewerAsset = { L12: body: string | Buffer; L13: contentType: string;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/diffs/src/viewer-assets.tsView on unpkg · L11

dist/update-cli-Cm_l3W29.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cm_l3W29.jsView on unpkg · L157

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L10

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/model-selection-L7RMwsG-.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/model-selection-L7RMwsG-.jsView on unpkg

dist/plugin-sdk/config-4Fgm-yEH.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-4Fgm-yEH.jsView on unpkg

dist/plugin-sdk/config-Di-lyCdh.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-Di-lyCdh.jsView on unpkg

dist/plugin-sdk/discord.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/model-auth-CX9cPHdC.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/model-auth-CX9cPHdC.jsView on unpkg

dist/plugin-sdk/bluebubbles.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/bluebubbles.jsView on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/plugin-sdk/dispatch-Cerq29sy.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cerq29sy.jsView on unpkg

dist/plugin-sdk/dispatch-Cndjtt0g.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cndjtt0g.jsView on unpkg

dist/plugin-sdk/feishu.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/feishu.jsView on unpkg

dist/plugin-sdk/googlechat.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/googlechat.jsView on unpkg

dist/plugin-sdk/imessage.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/imessage.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Findings

4 Critical24 High15 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/reply-C5LKjXcC.js

CriticalCredential Exfiltrationdist/reply-C5LKjXcC.js

CriticalRemote Asset Decode Executedist/reply-C5LKjXcC.js

CriticalTrigger Reachable Dangerous Capabilitydist/plugin-sdk/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/daemon-install-plan.shared-6BfiTrDp.js

HighShelldist/daemon-cli.js

HighEvalscripts/check-models-master.mjs

HighCredential Redirect Persistencedist/plugin-sdk/telegram.js

HighCommand Output Exfiltrationdist/daemon-cli.js

HighSandbox Evasion Gated Capabilitydist/daemon-install-plan.shared-6BfiTrDp.js

HighCloud Metadata Accessdist/shared-Cg8lr3fh.js

HighCross File Remote Execution Contextdist/compact-B247y5Qt.js

HighTrigger Reachable Credential Exfiltrationdist/reply-C5LKjXcC.js

HighTrigger Reachable Persistencedist/restart-BzjDMmkD.js

HighSemantic Analysis Limiteddist/logger-Bj0Xl6pn.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/model-selection-L7RMwsG-.js

HighKnown Malware Source Similaritydist/plugin-sdk/config-4Fgm-yEH.js

HighKnown Malware Source Similaritydist/plugin-sdk/config-Di-lyCdh.js

HighKnown Malware Source Similaritydist/plugin-sdk/discord.js

HighKnown Malware Source Similaritydist/plugin-sdk/model-auth-CX9cPHdC.js

HighKnown Malware Source Similaritydist/plugin-sdk/bluebubbles.js

HighKnown Malware Source Similaritydist/plugin-sdk/dispatch-BP0viZiL.js

HighKnown Malware Source Similaritydist/plugin-sdk/dispatch-Cerq29sy.js

HighKnown Malware Source Similaritydist/plugin-sdk/dispatch-Cndjtt0g.js

HighKnown Malware Source Similaritydist/plugin-sdk/feishu.js

HighKnown Malware Source Similaritydist/plugin-sdk/googlechat.js

HighKnown Malware Source Similaritydist/plugin-sdk/imessage.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/control-ui/assets/zh-TW-cW5xB87I.js

MediumDynamic Requiredist/daemon-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/update-cli-Cm_l3W29.js

MediumShips Wasm Modulenode_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py

MediumOversized Source Fileextensions/diffs/assets/viewer-runtime.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/control-ui/assets/es-DHtyqUQZ.js

MediumSecret Patterndist/control-ui/assets/zh-CN-BgJ8_lE3.js

MediumSecret Patterndist/control-ui/assets/index-CvRIBzDR.js

MediumSecret Patterndist/control-ui/assets/pt-BR-D2dJb9G8.js

MediumSecret Patterndist/control-ui/assets/de-DuUYLvt1.js

LowScripts Present

LowWeak Cryptoextensions/diffs/src/viewer-assets.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

41 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/control-ui/assets/zh-TW-cW5xB87I.jsView on unpkg · L1

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts

High

Child Process

Package source references child process execution.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

dist/daemon-cli.jsView file

High

Shell

Package source references shell execution.

dist/daemon-cli.jsView on unpkg · L3199

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L11

445const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L446: return createRequire ? createRequire(metaUrl) : null; L447: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L445

scripts/check-models-master.mjsView file

High

Eval

Package source references dynamic code evaluation.

scripts/check-models-master.mjsView on unpkg · L36

extensions/diffs/src/viewer-assets.tsView file

11export type ServedViewerAsset = { L12: body: string | Buffer; L13: contentType: string;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/diffs/src/viewer-assets.tsView on unpkg · L11

dist/update-cli-Cm_l3W29.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cm_l3W29.jsView on unpkg · L157

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L62

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L62

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L67

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L10

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@mariozechner/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/model-selection-L7RMwsG-.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/model-selection-L7RMwsG-.jsView on unpkg

dist/plugin-sdk/config-4Fgm-yEH.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-4Fgm-yEH.jsView on unpkg

dist/plugin-sdk/config-Di-lyCdh.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/config-Di-lyCdh.jsView on unpkg

dist/plugin-sdk/discord.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/model-auth-CX9cPHdC.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/model-auth-CX9cPHdC.jsView on unpkg

dist/plugin-sdk/bluebubbles.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/bluebubbles.jsView on unpkg

dist/plugin-sdk/dispatch-BP0viZiL.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-BP0viZiL.jsView on unpkg

dist/plugin-sdk/dispatch-Cerq29sy.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cerq29sy.jsView on unpkg

dist/plugin-sdk/dispatch-Cndjtt0g.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/dispatch-Cndjtt0g.jsView on unpkg

dist/plugin-sdk/feishu.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/feishu.jsView on unpkg

dist/plugin-sdk/googlechat.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/googlechat.jsView on unpkg

dist/plugin-sdk/imessage.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/imessage.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

johns-harness@2026.9.40

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code