lean-ctx-bin: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

lean-ctx-bin: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: L4: const { execFileSync, execSync } = require("child_process"); L5: const fs = require("fs"); L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L31: L32: function getTarget() { L33: const platform = process.platform; ... L42: const archMap = { x64: "x86_64", arm64: "aarch64" }; L43: const rustArch = archMap[arch];

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

3L4: const { execFileSync, execSync } = require("child_process"); L5: const fs = require("fs"); L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L11: const REPO = "yvgude/lean-ctx"; L12: const BIN_DIR = path.join(__dirname, "bin"); L13: const IS_WIN = process.platform === "win32"; L14: const BINARY_NAME = IS_WIN ? "lean-ctx.exe" : "lean-ctx"; ... L128: lastPct = pct;

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

postinstall.jsView on unpkg · L3

•matchType = token_shingles matchedPackage = lean-ctx-bin@3.10.3 matchedPath = postinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.10.3 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-43json

1{

2 "name": "lean-ctx-bin",

3 "version": "3.11.0",

4 "description": "LeanCTX Engine — the open-source runtime for the Context Gateway for AI Systems. Select context, apply supported controls, and inspect evidence. No Rust required.",

5 "keywords": [

6 "lean-ctx",

7 "context-gateway",

8 "context-engineering",

9 "mcp",

10 "llm",

11 "context",

12 "claude",

13 "cursor",

14 "ai",

15 "ai-agents",

16 "code-graph",

17 "token-optimization"

18 ],

19 "homepage": "https://leanctx.com",

20 "repository": {

21 "type": "git",

22 "url": "https://github.com/yvgude/lean-ctx.git",

23 "directory": "packages/lean-ctx-bin"

24 },

25 "license": "Apache-2.0",

26 "bin": {

27 "lean-ctx": "./bin/lean-ctx.js"

28 },

29 "scripts": {

30 "preinstall": "node preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "postinstall": "node postinstall.js"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "files": [

34 "bin/",

35 "preinstall.js",

36 "postinstall.js",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=16"

41 }

42}

43

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

postinstall.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3

4const { execFileSync, execSync } = require("child_process");

5const fs = require(

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.10.3 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg