kodelyth-ecc@2.5.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kodelyth-ecc@2.5.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

bin/kodelyth-ecc.jsView file

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

16L17: const { spawnSync } = require('child_process'); L18: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

scripts/hooks/stop-format-typecheck.jsView file

19const crypto = require('crypto'); L20: const { execFileSync, spawnSync } = require('child_process'); L21: const fs = require('fs'); ... L30: L31: // Characters cmd.exe treats as separators/operators when shell: true is used. L32: // Includes spaces and parentheses to guard paths like "C:\Users\John Doe\...". ... L41: const raw = L42: process.env.CLAUDE_SESSION_ID || L43: crypto.createHash('sha1').update(process.cwd()).digest('hex').slice(0, 12); L44: const sessionId = raw.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64); ... L63: try { L64: if (process.platform === 'win32' && resolved.bin.endsWith('.cmd')) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hooks/stop-format-typecheck.jsView on unpkg · L19

actions/ecc-review/run-review.jsView file

21const path = require('path'); L22: const { execSync } = require('child_process'); L23: const https = require('https'); L24: ... L36: L37: const bundle = (process.env.ECC_BUNDLE || 'red-team').trim(); L38: const agentsOverride = (process.env.ECC_AGENTS || '').split(',').map(s => s.trim()).filter(Boolean);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

actions/ecc-review/run-review.jsView on unpkg · L21

scripts/cli/menu.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kodelyth-ecc@2.4.9 matchedIdentity = npm:a29kZWx5dGgtZWNj:2.4.9 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/cli/menu.jsView on unpkg

114cleanup(); L115: console.log(`${C.cyan}Running: npm install -g kodelyth-ecc${C.reset}\n`); L116: const r = spawnSync('npm', ['install', '-g', 'kodelyth-ecc'], { stdio: 'inherit' }); L117: process.exit(r.status ?? 0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/cli/menu.jsView on unpkg · L114

install.shView file

•path = install.sh kind = build_helper sizeBytes = 34028 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

agents/load-tester.mdView file

157patternName = generic_password severity = medium line = 157 matchedText = password...ass"

Medium

Secret Pattern

Hardcoded password in agents/load-tester.md

agents/load-tester.mdView on unpkg · L157

commands/kotlin-test.mdView file

81patternName = generic_password severity = medium line = 81 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L81

93patternName = generic_password severity = medium line = 93 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L93

106patternName = generic_password severity = medium line = 106 matchedText = password...s1",

Medium

Secret Pattern

Hardcoded password in commands/kotlin-test.md

commands/kotlin-test.mdView on unpkg · L106

commands/rust-test.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L76

86patternName = generic_password severity = medium line = 86 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L86

101patternName = generic_password severity = medium line = 101 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L101

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

Source & flagged code

17 flagged

bin/kodelyth-ecc.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// Kodelyth ECC — npx entry point

3// Usage (from npm — recommended):

4// npx kodelyth-ecc # Claude Code (default)

5// npx kodelyth-ecc --target windsurf-project # Windsurf (project)

6// npx kodelyth-ecc --target windsurf-home # Windsurf (global)

7// npx kodelyth-ecc --target antigravity # Google Antigravity

8// npx kodelyth-ecc --target cursor-project # Cursor IDE

9// npx kodelyth-ecc --target codex-home # Codex CLI

10// npx kodelyth-ecc --target opencode # OpenCode

11//

12// Usage (from GitHub — latest commit):

13// npx github:sifxprime/kodelyth-ecc

14

15'use strict';

16

17const { spawnSync } = require('child_process');

18const path = require('path');

High

Child Process

Package source references child process execution.

bin/kodelyth-ecc.jsView on unpkg · L16

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kodelyth-ecc.jsView on unpkg · L16

19const fs = require('fs');

20const os = require('os');

21

22const ROOT = path.join(__dirname, '..');

23

24// Auto-migrate legacy ~/.kodelyth/ → ~/.kodelythecc/ on first run for existing users.

25// Idempotent; instant no-op if legacy dir is absent or migration marker exists.

26try { require(path.join(ROOT, 'scripts', 'migrate-legacy.js')).main(); } catch { /* best-effort */ }

27

28// zsh (unlike bash) passes inline comments as literal args — strip them

29const args = process.argv.slice(2).filter((a, i, arr) => {

30 if (a.startsWith('#')) return false; // drop # and everything after

31 const prev = arr.slice(0, i).findIndex(x => x.startsWith('#'));

32 return prev === -1;

33});

34const isWin = os.platform() === 'win32';

35

36// ── Interactive menu — fires when invoked with no args on a real terminal ───

scripts/hooks/stop-format-typecheck.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * Stop Hook: Batch format and typecheck all JS/TS files edited this response

4 *

5 * Cross-platform (Windows, macOS, Linux)

6 *

7 * Reads the accumulator written by post-edit-accumulator.js and processes all

8 * edited files in one pass: groups files by project root for a single formatter

9 * invocation per root, and groups .ts/.tsx files by tsconfig dir for a single

10 * tsc --noEmit per tsconfig. The accumulator is cleared on read so repeated

actions/ecc-review/run-review.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// Kodelyth ECC — GitHub Action review runner

3// Reads a PR diff + selected agents and produces a JSON findings report.

4//

5// Env contract:

6// ANTHROPIC_API_KEY Anthropic API key (required for live model call; if absent, runs in dry-mode)

7// ECC_BUNDLE indie-hacker | red-team | enterprise

8// ECC_AGENTS comma-separated agent names (overrides bundle if set)

9// ECC_MODEL Anthropic model id

10// ECC_MAX_FILES max changed files per run

scripts/cli/menu.jsView file

Lines 94-134javascript

94 hint: 'Detach dashboard as a daemon so /api routes stay reachable',

95 run: () => runBackground(),

96 });

97 opts.push({

98 label: 'Uninstall ECC completely',

99 hint: 'Remove agents/skills/commands/hooks, RTK hook, codebase-mcp, and ~/.kodelythecc/'

install.shView file

•path = install.sh kind = build_helper sizeBytes = 34028 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

agents/load-tester.mdView file

Lines 137-177markdown

137 - name: "Critical user flow"

138 weight: 70

139 flow:

140 - get:

141 url: "/items"

142 expect:

143 - statusCode: 200

144 - maxResponseTime: 200

145 - post:

commands/kotlin-test.mdView file

Lines 61-113markdown

61fun validateRegistration(request: RegistrationRequest): ValidationResult {

62 TODO("not implemented")

63}

64```

65

66## Step 2: Write Kotest Tests (RED)

67

68```kotlin

69// validator/RegistrationValidatorTest.kt

70package com.example.validator

71

72import io.kotest.core.spec.style.FunSpec

commands/rust-test.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L76

86patternName = generic_password severity = medium line = 86 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L86

101patternName = generic_password severity = medium line = 101 matchedText = password...o(),

Medium

Secret Pattern

Hardcoded password in commands/rust-test.md

commands/rust-test.mdView on unpkg · L101

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126