Loading npm security reports…

local-operator-ui@0.31.11: Suspicious npm security report (Warn) | LPM Firewall

registry / local-operator-ui / 0.31.11

local-operator-ui@0.31.11

User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed attack surface was identified. The install hook is scoped to Electron runtime setup and its own Chromium sandbox helper.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Package installation runs the declared postinstall hook; normal use launches the Electron application.

Impact

No credential theft, unrelated network export, broad control-surface mutation, or persistence mechanism was established.

Mechanism

The installer obtains Electron and conditionally repairs only its sandbox helper, with descriptor-based checks that reject unsafe file types.

AI rationale

The install-time privileged operation is narrowly limited to the package's Electron sandbox helper and includes anti-symlink safeguards. Inspected entry points show ordinary application launch, local backend health checks, and scheduling UI behavior rather than an attack.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

The declared postinstall runs the package-local postinstall script.
The installer obtains Electron and calls the sandbox-helper repair routine.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

3475}, L3476: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L3477: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L3475

•command output transform/external POST = ork; 30 is the stall bound and is deliberately well above a\n# slow-but-working link\'s answer time, because a probe that fails a working\n# connection is noise users learn to ignore.\n#\n# `--fail` turns an http error status into a non-zero exit (a proxy\'s 403/407,\n# any 4xx/5xx). it does not notice a captive portal answering 200 with its own\n# html page - measured, a portal-shaped 200 exits 0 with and without the flag -\n# so this check answers "did a request to the host complete", and the pypi probe\n# below is the one that also checks what came back.\ncheck_connectivity() {\n log "checking network connectivity..."\n local servers=("pypi.org" "bootstrap.pypa.io")\n local has_connectivity=false\n \n for server in "${servers[@]}"; do\n i

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L930: // The remaining gated legacy writes and reads the renderer still issued as L931: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L932: // through the main-process relay, so in managed mode these went out with no ... L2774: try { L2775: text = fs.readFileSync(file, "utf8"); L2776: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/postinstall.jsView file

9* step spawns the binary straight from `dist/` rather than through L10: * `require("electron")` (the one call that would fetch it on demand). So L11: * without this, a fresh clone or a cold CI runner fails its first

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L9

out/renderer/assets/schedules-page-Bxn30SeI.jsView file

13contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},ur=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-Bxn30SeI.jsView on unpkg · L13

out/renderer/assets/index-BoBj0LUC.jsView file

•path = out/renderer/assets/index-BoBj0LUC.js kind = oversized_source_file sizeBytes = 6091421 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-BoBj0LUC.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 46-86json

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "app:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless electron . --window-mode=headless",

54 "//app:headless": "The agent-driven launch, so it carries the notification kill switch (scripts/notifications-off.mjs) AND the telemetry switch (scripts/telemetry-off.mjs). `headless` silences this app's OWN banner and cannot reach the backend's: the app spawns a backend, and that backend's parked-gate announcement ends at `osascript` on macOS, whose banner lands in the operator's real Notification Center attributed to Script Editor. The telemetry switch matters because a run of this line boots the real app against the live PostHog project key its build carries, in BOTH processes - main co ...

55 "//dev": "The `.env` loader is `dotenv-cli`, whose default is NOT to overwrite a variable that is already in the environment - and that non-override is load-bearing rather than incidental. `dev` used to be `npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'`, added so a checkout's `.env` would beat variables a Cursor/vscode terminal injects; that inner re-export runs AFTER any prefix the caller put on the line, so `pnpm dev:headless` (whose whole guarantee is the launch-side switch) could be re-armed by a `.env` line reading LOCAL_OPERATOR_UI_TELEM ...

56 "dev": "npx dotenv-cli -e .env -- electron-vite dev",

57 "//dev:headless": "The env var is the only channel this launch can carry a mode on. electron-vite dev spawns Electron itself from its OWN option parser and forwards nothing extra: measured, neither an appended argument nor its shipped ELECTRON_CLI_ARGS passthrough reaches the app's argv (the run reported the default 1380x900 when the passthrough asked for 1024x768). It does not need the flag: a second launch forwards the mode it resolved to the instance holding the lock (src/main/window-raise.ts), which is the channel this env var already feeds.",

58 "dev:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless pnpm dev",

59 "build": "electron-vite build",

60 "//prebuild": "The build compiles main/preload to V8 bytecode for the pinned Electron, so it needs a real node_modules/electron/dist before electron-vite runs. Since Electron 42 nothing fetches that during an install except our own postinstall, so this hook covers the trees that hook cannot reach (--ignore-scripts, or a dist/ removed by hand) and fails the build by name instead of letting it die inside the bytecode step with an ENOENT. build:npm needs no runtime: it deliberately emits plain JS (LOCAL_OPERATOR_UI_NO_BYTECODE=true).",

61 "prebuild": "node ./bin/ensure-electron.js",

62 "prebuild:npm": "rm -rf out/main out/preload",

63 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

64 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

65 "postbuild": "chmod +x ./bin/local-operator-ui.js",

66 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

68 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

69 "//lint:scripts": "`pnpm lint` names the paths it checks by hand, so the whole of `scripts/` - the proof harnesses, evidence rigs and release gates - sat outside the lint and formatter contracts, and a formatter error rode into a merged pull request green. This gate runs the same `biome check` over the `scripts/` files a change touches against a base ref (`origin/main` locally, the merge commit's first parent in CI), so a violation cannot ride in with the diff that introduces it, while the tree's 106 pre-existing offenders are burnt down file by file rather than turned red at once. Widenin ...

70 "lint:scripts": "node scripts/check-scripts-lint.mjs",

71 "format": "pnpm biome format src",

72 "format:fix": "pnpm biome format --write src",

73 "prepack": "pnpm run build:npm",

74 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

75 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

76 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

77 "check-changed": "node scripts/ci-scope.mjs --since \"$(git merge-base origin/main HEAD)\" --run",

78 "test:session-cookies": "node scripts/session-cookie-electron.test.mjs",

79 "test:desktop": "node scripts/run-desktop-tests.mjs scripts/update-fleet-drain.test.mjs scripts/at-mentions.test.mjs scripts/directory-listing.test.mjs scripts/slash-token.test.mjs scripts/slash-rank.test.mjs scripts/slash-submit.test.mjs scripts/slash-highlight.test.mjs scripts/slash-contract.test.mjs scripts/slash-row-format.test.mjs scripts/owned-serve-lifecycle.test.mjs scripts/launcher-watch.test.mjs scripts/linux-sandbox.test.mjs scripts/capture-evidence.test.mjs scripts/desktop-contract.test.mjs scripts/transcript-reducer.test.mjs scripts/tool-compose-lifecycle.test.mjs scripts/tran ...

80 "check-themes": "node scripts/generate-theme-css.mjs --check && node scripts/contrast-contract.mjs",

81 "check-vendored": "node scripts/check-vendored.mjs",

82 "check-evidence": "node scripts/check-evidence.mjs",

83 "check-evidence:parity": "node scripts/evidence-histogram-parity.mjs",

84 "check-edit-diffs": "node scripts/check-edit-diffs.mjs",

85 "check-runtime-deps": "node scripts/check-runtime-deps.mjs",

86 "gen-themes": "node scripts/generate-theme-css.mjs",

Long lines were clipped for display.

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

3475}, L3476: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L3477: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L3475

•command output transform/external POST = ork; 30 is the stall bound and is deliberately well above a\n# slow-but-working link\'s answer time, because a probe that fails a working\n# connection is noise users learn to ignore.\n#\n# `--fail` turns an http error status into a non-zero exit (a proxy\'s 403/407,\n# any 4xx/5xx). it does not notice a captive portal answering 200 with its own\n# html page - measured, a portal-shaped 200 exits 0 with and without the flag -\n# so this check answers "did a request to the host complete", and the pypi probe\n# below is the one that also checks what came back.\ncheck_connectivity() {\n log "checking network connectivity..."\n local servers=("pypi.org" "bootstrap.pypa.io")\n local has_connectivity=false\n \n for server in "${servers[@]}"; do\n i

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L930: // The remaining gated legacy writes and reads the renderer still issued as L931: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L932: // through the main-process relay, so in managed mode these went out with no ... L2774: try { L2775: text = fs.readFileSync(file, "utf8"); L2776: } catch {

bin/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Two install-time duties, one script, because both are "the install did not

5 * leave this tree runnable" problems and npm's lifecycle gives us one hook:

6 *

7 * 1. Fetch the Electron runtime. Since Electron 42 the `electron` package has

8 * no postinstall that downloads the binary, and `electron-vite`'s bytecode

9 * step spawns the binary straight from `dist/` rather than through

10 * `require("electron")` (the one call that would fetch it on demand). So

11

out/renderer/assets/schedules-page-Bxn30SeI.jsView file

Lines 1-33javascript

1import{r as p,h as Ni,j as u,i as Ai,k as Cu,s as Zs,f as ns,e as ae,l as Su,b as Mt,m as le,n as Ie,o as Js,p

out/renderer/assets/index-BoBj0LUC.jsView file

•path = out/renderer/assets/index-BoBj0LUC.js kind = oversized_source_file sizeBytes = 6091421 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-BoBj0LUC.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg