local-operator-ui: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

local-operator-ui: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

4377}, L4378: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4379: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4377

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1197: // The remaining gated legacy writes and reads the renderer still issued as L1198: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1199: // through the main-process relay, so in managed mode these went out with no ... L3676: try { L3677: text = fs.readFileSync(file, "utf8"); L3678: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/postinstall.jsView file

9* step spawns the binary straight from `dist/` rather than through L10: * `require("electron")` (the one call that would fetch it on demand). So L11: * without this, a fresh clone or a cold CI runner fails its first

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L9

out/renderer/assets/schedules-page-DXBfewzG.jsView file

13contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},ur=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-DXBfewzG.jsView on unpkg · L13

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

out/renderer/assets/conversation-input-sync-tkg-UMLM.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = local-operator-ui@0.32.6 matchedIdentity = npm:bG9jYWwtb3BlcmF0b3ItdWk:0.32.6 similarity = 0.911 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/renderer/assets/conversation-input-sync-tkg-UMLM.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 46-86json

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "app:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless electron . --window-mode=headless",

54 "//app:headless": "The agent-driven launch, so it carries the notification kill switch (scripts/notifications-off.mjs) AND the telemetry switch (scripts/telemetry-off.mjs). `headless` silences this app's OWN banner and cannot reach the backend's: the app spawns a backend, and that backend's parked-gate announcement ends at `osascript` on macOS, whose banner lands in the operator's real Notification Center attributed to Script Editor. The telemetry switch matters because a run of this line boots the real app against the live PostHog project key its build carries, in BOTH processes - main co ...

55 "//dev": "The `.env` loader is `dotenv-cli`, whose default is NOT to overwrite a variable that is already in the environment - and that non-override is load-bearing rather than incidental. `dev` used to be `npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'`, added so a checkout's `.env` would beat variables a Cursor/vscode terminal injects; that inner re-export runs AFTER any prefix the caller put on the line, so `pnpm dev:headless` (whose whole guarantee is the launch-side switch) could be re-armed by a `.env` line reading LOCAL_OPERATOR_UI_TELEM ...

56 "dev": "npx dotenv-cli -e .env -- electron-vite dev",

57 "//dev:headless": "The env var is the only channel this launch can carry a mode on. electron-vite dev spawns Electron itself from its OWN option parser and forwards nothing extra: measured, neither an appended argument nor its shipped ELECTRON_CLI_ARGS passthrough reaches the app's argv (the run reported the default 1380x900 when the passthrough asked for 1024x768). It does not need the flag: a second launch forwards the mode it resolved to the instance holding the lock (src/main/window-raise.ts), which is the channel this env var already feeds.",

58 "dev:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless pnpm dev",

59 "build": "electron-vite build",

60 "//prebuild": "The build compiles main/preload to V8 bytecode for the pinned Electron, so it needs a real node_modules/electron/dist before electron-vite runs. Since Electron 42 nothing fetches that during an install except our own postinstall, so this hook covers the trees that hook cannot reach (--ignore-scripts, or a dist/ removed by hand) and fails the build by name instead of letting it die inside the bytecode step with an ENOENT. build:npm needs no runtime: it deliberately emits plain JS (LOCAL_OPERATOR_UI_NO_BYTECODE=true).",

61 "prebuild": "node ./bin/ensure-electron.js",

62 "prebuild:npm": "rm -rf out/main out/preload",

63 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

64 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

65 "postbuild": "chmod +x ./bin/local-operator-ui.js",

66 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "//prepare": "Wires this clone's pushes through the tracked .githooks/pre-push, so a worktree that would otherwise push ungated is either gated or refused loudly - git skips a hook file that is not there, in silence, which is exactly the state a fresh worktree is in. Not bin/postinstall.js, whose own contract is that it must never fail the install: a wiring that cannot be verified has to say so rather than report a success. Runs on `pnpm install` in a checkout and on a git-based install, and never for a published tarball's consumer, which has no repository to wire. pnpm hooks:install is th ...

68 "//prepare:evidence-fold": "Wires the clone merge driver for docs/evidence/manifest.json, so `git merge` does not stop on a manifest a sibling lane also rewrote. It runs from `prepare` for the same reason the hooks wiring does: a fresh clone (and every worktree of it, since the config is the clone LOCAL one) would otherwise fold with the driver missing, and the failure that produces is a conflict nobody knows to expect. Same contract as the hooks wiring - it fails loudly by hand and never fails the install, where `postinstall` owns the opposite rule. pnpm evidence:fold:install and pnpm evi ...

69 "prepare": "node scripts/hooks-install.mjs --tolerate-failure && node scripts/evidence-fold.mjs --install --tolerate-failure",

70 "//hooks:install": "Idempotent, and safe to run at any time: it repoints core.hooksPath at <common git dir>/lop-hooks, whose pre-push runs the gate THE CURRENT WORKTREE carries. The directory lives in the clone's shared git directory and the path is absolute because a relative core.hooksPath is resolved against the working directory and a path that does not resolve is skipped by git without a word - which is how a worktree pushed ungated while reporting no problem.",

71 "hooks:install": "node scripts/hooks-install.mjs",

72 "hooks:check": "node scripts/hooks-install.mjs --check",

73 "//evidence:fold": "Completes an evidence fold: resolves docs/evidence/manifest.json across a merge a FIELD at a time (not whole-file, and not per entry), re-derives the counts from the merged tree, runs the real guards over the result and stages it - so a fold is ONE commit that carries correct values instead of a merge plus a hand re-lay. Reads the three sides from GIT OBJECTS, so it works on a conflicted working file too. It never weakens a guard - every field the manifest still claims about its tree is written by this tool and then checked by the real guards - and a fold that moved onl ...

74 "evidence:fold": "node scripts/evidence-fold.mjs",

75 "evidence:fold:install": "node scripts/evidence-fold.mjs --install",

76 "evidence:fold:check": "node scripts/evidence-fold.mjs --check",

77 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

78 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

79 "//lint:scripts": "`pnpm lint` names the paths it checks by hand, so the whole of `scripts/` - the proof harnesses, evidence rigs and release gates - sat outside the lint and formatter contracts, and a formatter error rode into a merged pull request green. This gate runs the same `biome check` over the `scripts/` files a change touches against a base ref (`origin/main` locally, the merge commit's first parent in CI), so a violation cannot ride in with the diff that introduces it, while the tree's 106 pre-existing offenders are burnt down file by file rather than turned red at once. Widenin ...

80 "lint:scripts": "node scripts/check-scripts-lint.mjs",

81 "format": "pnpm biome format src",

82 "format:fix": "pnpm biome format --write src",

83 "prepack": "pnpm run build:npm",

84 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

85 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

86 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

Long lines were clipped for display.

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

4377}, L4378: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4379: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4377

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1197: // The remaining gated legacy writes and reads the renderer still issued as L1198: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1199: // through the main-process relay, so in managed mode these went out with no ... L3676: try { L3677: text = fs.readFileSync(file, "utf8"); L3678: } catch {

bin/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Two install-time duties, one script, because both are "the install did not

5 * leave this tree runnable" problems and npm's lifecycle gives us one hook:

6 *

7 * 1. Fetch the Electron runtime. Since Electron 42 the `electron` package has

8 * no postinstall that downloads the binary, and `electron-vite`'s bytecode

9 * step spawns the binary straight from `dist/` rather than through

10 * `require("electron")` (the one call that would fetch it on demand). So

11

out/renderer/assets/schedules-page-DXBfewzG.jsView file

Lines 1-33javascript

1import{r as p,h as Ni,j as u,i as Ai,k as Cu,s as Zs,f as ns,e as ae,l as Su,b as Mt,m as le,n as Ie,o as Js,p

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

out/renderer/assets/conversation-input-sync-tkg-UMLM.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = local-operator-ui@0.32.6 matchedIdentity = npm:bG9jYWwtb3BlcmF0b3ItdWk:0.32.6 similarity = 0.911 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/renderer/assets/conversation-input-sync-tkg-UMLM.jsView on unpkg