kandown@0.18.0: Suspicious npm security report (Warn)

Loading npm security reports…

kandown@0.18.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

bin/kandown.jsView file

Lines 24-88javascript

24 * → migrateTasksToTopLevel — silently moves legacy .kandown/tasks/ → ./tasks/

25 * → cmdInit — installs `.kandown` and top-level `tasks/`

26 * → cmdUpdate — refreshes installed kandown.html

27 * → injectServerRoot — injects the CLI server root into single-file HTML

28 * → createServeServer — creates the local zero-dependency HTTP server

29 * → readDaemonMetadata — reads per-project daemon status metadata

30 * → startDaemon — starts/reconnects the per-project web daemon

31 * → stopDaemon — stops the per-project web daemon

32 * → cmdDaemon — daemon lifecycle command router

33 * → cmdServe — starts/reconnects the daemon, opens web UI, and launches the board TUI

34 * → main — dispatches CLI commands

35 *

36 * @exports none

37 */

38/* eslint-disable no-console */

39// 📖 DEV=false prevents Ink from loading react-devtools-core (CJS-only, breaks ESM).

40// Must be set BEFORE any imports because ESM hoists all import statements.

41process.env.DEV = 'false';

42// 📖 Polyfill browser globals that some bundled modules expect.

43if (typeof globalThis.self === 'undefined') Object.defineProperty(globalThis, 'self', { value: globalThis });

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis });

45// 📖 Make require() available in this ESM module so bundled __require() shims work.

46// tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

47import { createRequire } from 'node:module';

48globalThis.require = createRequire(import.meta.url);

50import { fileURLToPath } from 'node:url';

51import { createServer } from 'node:http';

52import { dirname, join, resolve } from 'node:path';

53import { homedir } from 'node:os';

54import {

55 existsSync,

56 mkdirSync,

57 copyFileSync,

58 readFileSync,

59 writeFileSync,

60 readdirSync,

61 statSync,

62 unlinkSync,

63 renameSync,

64 rmSync,

65 openSync,

66 writeSync,

67 closeSync,

68} from 'node:fs';

69import { spawn, execSync } from 'node:child_process';

70import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L68

71import { randomBytes } from 'node:crypto';

73// 📖 Global safety net: a stray exception or unhandled rejection prints a clean

74// one-liner instead of a raw stack trace. The daemon (KANDOWN_DAEMON=1) logs

75// and keeps serving — a single bad request must not take the web UI down.

76// Set KANDOWN_DEBUG=1 to get the full stack.

77function handleFatal(kind, e) {

78 const msg = e instanceof Error ? e.message : String(e);

79 console.error(`\x1b[31m✗\x1b[0m kandown ${kind}: ${msg}`);

80 if (process.env.KANDOWN_DEBUG && e instanceof Error) console.error(e.stack);

81 if (process.env.KANDOWN_DAEMON !== '1') process.exit(1);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/kandown.jsView on unpkg · L68

82}

83process.on('uncaughtException', (e) => handleFatal('crashed', e));

84process.on('unhandledRejection', (e) => handleFatal('internal error', e));

86const __filename = fileURLToPath(import.meta.url);

87const __dirname = dirname(__filename);

88const PKG_ROOT = resolve(__dirname, '..');

Lines 281-321javascript

281 stdio: ['pipe', 'pipe', 'pipe'],

282 env: { ...process.env },

283 detached: false,

284 });

285 child.stderr.on('data', () => {});

Lines 2419-2459javascript

2419 if (pids.length === 0) return null;

2420 pid = parseInt(pids[0], 10);

2421 if (isNaN(pid) || pid ===

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2719279 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2719279 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/kandown.jsView file

68} from 'node:fs'; L69: import { spawn, execSync } from 'node:child_process'; L70: import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L68

2439// macOS L2440: cwd = execSync(`lsof -p ${pid} -Fn -a -d cwd 2>/dev/null | grep '^n' | cut -c2-`, { encoding: 'utf8', timeout: 2000, shell: true }).trim(); L2441: }

High

Shell

Package source references shell execution.

bin/kandown.jsView on unpkg · L2439

68} from 'node:fs'; L69: import { spawn, execSync } from 'node:child_process'; L70: import { createConnection } from 'node:net'; L71: import { randomBytes } from 'node:crypto'; ... L79: console.error(`\x1b[31m✗\x1b[0m kandown ${kind}: ${msg}`); L80: if (process.env.KANDOWN_DEBUG && e instanceof Error) console.error(e.stack); L81: if (process.env.KANDOWN_DAEMON !== '1') process.exit(1);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/kandown.jsView on unpkg · L68

301tuiDone('✗', `${c.yellow}Auto-update failed${c.reset} — continuing with current version`); L302: log(` Run ${c.cyan}npm install -g kandown${c.reset} to upgrade manually`); L303: log(''); ... L308: const postVersion = await new Promise((resolve) => { L309: const child = spawn('npm', ['view', 'kandown', 'version'], { L310: timeout: 5000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kandown.jsView on unpkg · L301

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis }); L45: // 📖 Make require() available in this ESM module so bundled __require() shims work. L46: // tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2719279 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2719279 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg

Source & flagged code

7 flagged

bin/kandown.jsView file

Lines 24-88javascript

24 * → migrateTasksToTopLevel — silently moves legacy .kandown/tasks/ → ./tasks/

25 * → cmdInit — installs `.kandown` and top-level `tasks/`

26 * → cmdUpdate — refreshes installed kandown.html

27 * → injectServerRoot — injects the CLI server root into single-file HTML

28 * → createServeServer — creates the local zero-dependency HTTP server

29 * → readDaemonMetadata — reads per-project daemon status metadata

30 * → startDaemon — starts/reconnects the per-project web daemon

31 * → stopDaemon — stops the per-project web daemon

32 * → cmdDaemon — daemon lifecycle command router

33 * → cmdServe — starts/reconnects the daemon, opens web UI, and launches the board TUI

34 * → main — dispatches CLI commands

35 *

36 * @exports none

37 */

38/* eslint-disable no-console */

39// 📖 DEV=false prevents Ink from loading react-devtools-core (CJS-only, breaks ESM).

40// Must be set BEFORE any imports because ESM hoists all import statements.

41process.env.DEV = 'false';

42// 📖 Polyfill browser globals that some bundled modules expect.

43if (typeof globalThis.self === 'undefined') Object.defineProperty(globalThis, 'self', { value: globalThis });

44if (typeof globalThis.window === 'undefined') Object.defineProperty(globalThis, 'window', { value: globalThis });

45// 📖 Make require() available in this ESM module so bundled __require() shims work.

46// tsup's __require checks `typeof require !== "undefined"` — this makes it truthy.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kandown.jsView on unpkg · L44

47import { createRequire } from 'node:module';

48globalThis.require = createRequire(import.meta.url);

50import { fileURLToPath } from 'node:url';

51import { createServer } from 'node:http';

52import { dirname, join, resolve } from 'node:path';

53import { homedir } from 'node:os';

54import {

55 existsSync,

56 mkdirSync,

57 copyFileSync,

58 readFileSync,

59 writeFileSync,

60 readdirSync,

61 statSync,

62 unlinkSync,

63 renameSync,

64 rmSync,

65 openSync,

66 writeSync,

67 closeSync,

68} from 'node:fs';

69import { spawn, execSync } from 'node:child_process';

70import { createConnection } from 'node:net';

High

Child Process

Package source references child process execution.

bin/kandown.jsView on unpkg · L68

71import { randomBytes } from 'node:crypto';

73// 📖 Global safety net: a stray exception or unhandled rejection prints a clean

74// one-liner instead of a raw stack trace. The daemon (KANDOWN_DAEMON=1) logs

75// and keeps serving — a single bad request must not take the web UI down.

76// Set KANDOWN_DEBUG=1 to get the full stack.

77function handleFatal(kind, e) {

78 const msg = e instanceof Error ? e.message : String(e);

79 console.error(`\x1b[31m✗\x1b[0m kandown ${kind}: ${msg}`);

80 if (process.env.KANDOWN_DEBUG && e instanceof Error) console.error(e.stack);

81 if (process.env.KANDOWN_DAEMON !== '1') process.exit(1);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/kandown.jsView on unpkg · L68

82}

83process.on('uncaughtException', (e) => handleFatal('crashed', e));

84process.on('unhandledRejection', (e) => handleFatal('internal error', e));

86const __filename = fileURLToPath(import.meta.url);

87const __dirname = dirname(__filename);

88const PKG_ROOT = resolve(__dirname, '..');

Lines 281-321javascript

281 stdio: ['pipe', 'pipe', 'pipe'],

282 env: { ...process.env },

283 detached: false,

284 });

285 child.stderr.on('data', () => {});

Lines 2419-2459javascript

2419 if (pids.length === 0) return null;

2420 pid = parseInt(pids[0], 10);

2421 if (isNaN(pid) || pid ===

bin/tui.jsView file

•path = bin/tui.js kind = oversized_source_file sizeBytes = 2719279 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/tui.jsView on unpkg

•path = bin/tui.js kind = oversized_cli_entrypoint sizeBytes = 2719279 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/tui.jsView on unpkg

kandown@0.18.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code