kcgrouter@0.10.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kcgrouter@0.10.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = bun scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = kcgrouter@0.9.1 matchedIdentity = npm:a2Nncm91dGVy:0.9.1 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.mjsView on unpkg

6// because creating symlinks requires admin privileges / Developer Mode. L7: import { execSync } from "node:child_process"; L8: import { chmodSync, copyFileSync, existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L6

6// because creating symlinks requires admin privileges / Developer Mode. L7: import { execSync } from "node:child_process"; L8: import { chmodSync, copyFileSync, existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs"; ... L21: function resolveTraybin() { L22: let dir = process.cwd(); L23: for (;;) { ... L35: win32: { src: "tray_windows_release.exe", link: "tray_windows.exe" }, L36: }[process.platform]; L37: ... L64: const HOME = homedir(); L65: const KCGRouter_HOME = process.env.KCGRouter_HOME || join(HOME, ".kcgrouter"); L66: const isWin = process.platform === "win32";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.mjsView on unpkg · L6

src/server/providers/qoder/cosy.tsView file

50L51: function pkcs7Pad(data: Buffer, blockSize: number): Buffer { L52: const padding = blockSize - (data.length % blockSize); ... L57: L58: function aesEncryptCbcBase64(plaintext: string, keyStr: string): string { L59: const keyBytes = Buffer.from(keyStr, "utf8"); ... L125: * @param creds Credentials used for signing. L126: * @returns Header map ready to merge onto fetch(). L127: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/server/providers/qoder/cosy.tsView on unpkg · L50

src/server/routes/settings.routes.tsView file

34try { L35: execSync("bun --version", { stdio: "pipe" }); L36: return { name: "bun", updateCmd: "bun i -g kcgrouter" }; L37: } catch { L38: return { name: "npm", updateCmd: "npm i -g kcgrouter" }; L39: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/server/routes/settings.routes.tsView on unpkg · L34

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "bunfig.toml",

18 "tsconfig.json",

19 "!src/**/__tests__/**",

20 "!src/**/*.test.ts",

21 "!src/**/*.test.tsx",

22 "!src/test-setup.ts"

23 ],

24 "engines": {

25 "bun": ">=1.2.3"

26 },

27 "scripts": {

28 "dev": "bun --hot src/index.ts",

29 "start": "NODE_ENV=production bun src/index.ts",

30 "build": "bun run build.ts",

31 "check": "biome check --write ./src",

32 "lint": "biome lint --write ./src",

33 "format": "biome format --write ./src",

34 "gen-env": "bash scripts/gen-env.sh",

35 "generate-icon": "bun scripts/generate-icon.ts",

36 "test": "bash scripts/test.sh",

37 "postinstall": "bun scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepublishOnly": "bun run build"

39 },

40 "dependencies": {

41 "@clack/prompts": "^1.7.0",

42 "@radix-ui/react-label": "^2.1.7",

43 "@radix-ui/react-select": "^2.2.6",

44 "@radix-ui/react-slot": "^1.2.3",

45 "bun-plugin-tailwind": "^0.1.2",

46 "class-variance-authority": "^0.7.1",

47 "clsx": "^2.1.1",

48 "jsonc-parser": "^3.3.1",

49 "lucide-react": "^1",

50 "radix-ui": "^1.6.7",

51 "react": "^19",

52 "react-dom": "^19",

53 "recharts": "^3.10.1",

54 "sonner": "^2.0.7",

55 "systray2": "^2.1.4",

56 "tailwind-merge": "^3.3.1",

57 "tailwindcss": "^4.1.11",

scripts/postinstall.mjsView file

Lines 1-26javascript

1// Cross-platform postinstall: prepares systray2's native tray binaries and

2// registers kcgrouter to start automatically at user login.

3// On Unix it makes them executable and creates the platform symlinks that

4// systray2 looks for in debug mode. On Windows (where `chmod`/`ln` are not

5// available in bun's shell) it copies the binary instead of symlinking,

6// because creating symlinks requires admin privileges / Developer Mode.

7import { execSync } from "node:child_process";

8import { chmodSync, copyFileSync, existsSync, mkdirSync, symlinkSync, unlinkSync, writeFileSync }

src/server/providers/qoder/cosy.tsView file

Lines 30-70typescript

30 QODER_MACHINE_OS,

31 QODER_MACHINE_TYPE,

32 QODER_RSA_PUBLIC_KEY,

33} from "./constants";

34

35export interface CosyCreds {

36

src/server/routes/settings.routes.tsView file

Lines 14-54typescript

14 updateCommand: string;

15 fetchedAt: number;

16} | null = null;

17

18const VERSION_CACHE_TTL = 60