Loading npm security reports…

local-operator-ui@0.31.18: Suspicious npm security report (Warn) | LPM Firewall

registry / local-operator-ui / 0.31.18

local-operator-ui@0.31.18

User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No malicious attack surface was identified in the inspected entrypoints or required renderer assets.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Normal installation or explicit CLI launch.

Impact

No confirmed credential theft, remote payload execution, persistence, or foreign agent-control mutation was found.

Mechanism

The package installs and launches its Electron application; inspected MCP calls are relative local-backend requests.

AI rationale

The lifecycle hook and privileged Linux helper behavior are package-aligned Electron runtime and sandbox handling with regular-file safeguards. No concrete malicious behavior was found in the required source paths.

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

The manifest defines the Electron main and CLI entrypoints; its only install hook invokes the package postinstall script.
The required renderer location implements local file-name scoring for a picker.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

3739}, L3740: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L3741: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L3739

•command output transform/external POST = ork; 30 is the stall bound and is deliberately well above a\n# slow-but-working link\'s answer time, because a probe that fails a working\n# connection is noise users learn to ignore.\n#\n# `--fail` turns an http error status into a non-zero exit (a proxy\'s 403/407,\n# any 4xx/5xx). it does not notice a captive portal answering 200 with its own\n# html page - measured, a portal-shaped 200 exits 0 with and without the flag -\n# so this check answers "did a request to the host complete", and the pypi probe\n# below is the one that also checks what came back.\ncheck_connectivity() {\n log "checking network connectivity..."\n local servers=("pypi.org" "bootstrap.pypa.io")\n local has_connectivity=false\n \n for server in "${servers[@]}"; do\n i

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1006: // The remaining gated legacy writes and reads the renderer still issued as L1007: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1008: // through the main-process relay, so in managed mode these went out with no ... L3038: try { L3039: text = fs.readFileSync(file, "utf8"); L3040: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/postinstall.jsView file

9* step spawns the binary straight from `dist/` rather than through L10: * `require("electron")` (the one call that would fetch it on demand). So L11: * without this, a fresh clone or a cold CI runner fails its first

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L9

out/renderer/assets/schedules-page-CbOATI1U.jsView file

13contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},ur=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-CbOATI1U.jsView on unpkg · L13

out/renderer/assets/index-BDPyvriR.jsView file

•path = out/renderer/assets/index-BDPyvriR.js kind = oversized_source_file sizeBytes = 5871583 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-BDPyvriR.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 46-86json

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "app:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless electron . --window-mode=headless",

54 "//app:headless": "The agent-driven launch, so it carries the notification kill switch (scripts/notifications-off.mjs) AND the telemetry switch (scripts/telemetry-off.mjs). `headless` silences this app's OWN banner and cannot reach the backend's: the app spawns a backend, and that backend's parked-gate announcement ends at `osascript` on macOS, whose banner lands in the operator's real Notification Center attributed to Script Editor. The telemetry switch matters because a run of this line boots the real app against the live PostHog project key its build carries, in BOTH processes - main co ...

55 "//dev": "The `.env` loader is `dotenv-cli`, whose default is NOT to overwrite a variable that is already in the environment - and that non-override is load-bearing rather than incidental. `dev` used to be `npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'`, added so a checkout's `.env` would beat variables a Cursor/vscode terminal injects; that inner re-export runs AFTER any prefix the caller put on the line, so `pnpm dev:headless` (whose whole guarantee is the launch-side switch) could be re-armed by a `.env` line reading LOCAL_OPERATOR_UI_TELEM ...

56 "dev": "npx dotenv-cli -e .env -- electron-vite dev",

57 "//dev:headless": "The env var is the only channel this launch can carry a mode on. electron-vite dev spawns Electron itself from its OWN option parser and forwards nothing extra: measured, neither an appended argument nor its shipped ELECTRON_CLI_ARGS passthrough reaches the app's argv (the run reported the default 1380x900 when the passthrough asked for 1024x768). It does not need the flag: a second launch forwards the mode it resolved to the instance holding the lock (src/main/window-raise.ts), which is the channel this env var already feeds.",

58 "dev:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless pnpm dev",

59 "build": "electron-vite build",

60 "//prebuild": "The build compiles main/preload to V8 bytecode for the pinned Electron, so it needs a real node_modules/electron/dist before electron-vite runs. Since Electron 42 nothing fetches that during an install except our own postinstall, so this hook covers the trees that hook cannot reach (--ignore-scripts, or a dist/ removed by hand) and fails the build by name instead of letting it die inside the bytecode step with an ENOENT. build:npm needs no runtime: it deliberately emits plain JS (LOCAL_OPERATOR_UI_NO_BYTECODE=true).",

61 "prebuild": "node ./bin/ensure-electron.js",

62 "prebuild:npm": "rm -rf out/main out/preload",

63 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

64 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

65 "postbuild": "chmod +x ./bin/local-operator-ui.js",

66 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

68 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

69 "//lint:scripts": "`pnpm lint` names the paths it checks by hand, so the whole of `scripts/` - the proof harnesses, evidence rigs and release gates - sat outside the lint and formatter contracts, and a formatter error rode into a merged pull request green. This gate runs the same `biome check` over the `scripts/` files a change touches against a base ref (`origin/main` locally, the merge commit's first parent in CI), so a violation cannot ride in with the diff that introduces it, while the tree's 106 pre-existing offenders are burnt down file by file rather than turned red at once. Widenin ...

70 "lint:scripts": "node scripts/check-scripts-lint.mjs",

71 "format": "pnpm biome format src",

72 "format:fix": "pnpm biome format --write src",

73 "prepack": "pnpm run build:npm",

74 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

75 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

76 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

77 "check-changed": "node scripts/ci-scope.mjs --since \"$(git merge-base origin/main HEAD)\" --run",

78 "test:session-cookies": "node scripts/session-cookie-electron.test.mjs",

79 "test:desktop": "node scripts/run-desktop-tests.mjs scripts/update-fleet-drain.test.mjs scripts/at-mentions.test.mjs scripts/directory-listing.test.mjs scripts/slash-token.test.mjs scripts/slash-rank.test.mjs scripts/slash-submit.test.mjs scripts/slash-highlight.test.mjs scripts/slash-contract.test.mjs scripts/slash-row-format.test.mjs scripts/owned-serve-lifecycle.test.mjs scripts/launcher-watch.test.mjs scripts/linux-sandbox.test.mjs scripts/capture-evidence.test.mjs scripts/desktop-contract.test.mjs scripts/transcript-reducer.test.mjs scripts/tool-compose-lifecycle.test.mjs scripts/tran ...

80 "check-themes": "node scripts/generate-theme-css.mjs --check && node scripts/contrast-contract.mjs",

81 "check-vendored": "node scripts/check-vendored.mjs",

82 "check-evidence": "node scripts/check-evidence.mjs",

83 "check-evidence:parity": "node scripts/evidence-histogram-parity.mjs",

84 "check-edit-diffs": "node scripts/check-edit-diffs.mjs",

85 "check-runtime-deps": "node scripts/check-runtime-deps.mjs",

86 "gen-themes": "node scripts/generate-theme-css.mjs",

Long lines were clipped for display.

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

3739}, L3740: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L3741: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L3739

•command output transform/external POST = ork; 30 is the stall bound and is deliberately well above a\n# slow-but-working link\'s answer time, because a probe that fails a working\n# connection is noise users learn to ignore.\n#\n# `--fail` turns an http error status into a non-zero exit (a proxy\'s 403/407,\n# any 4xx/5xx). it does not notice a captive portal answering 200 with its own\n# html page - measured, a portal-shaped 200 exits 0 with and without the flag -\n# so this check answers "did a request to the host complete", and the pypi probe\n# below is the one that also checks what came back.\ncheck_connectivity() {\n log "checking network connectivity..."\n local servers=("pypi.org" "bootstrap.pypa.io")\n local has_connectivity=false\n \n for server in "${servers[@]}"; do\n i

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1006: // The remaining gated legacy writes and reads the renderer still issued as L1007: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1008: // through the main-process relay, so in managed mode these went out with no ... L3038: try { L3039: text = fs.readFileSync(file, "utf8"); L3040: } catch {

bin/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Two install-time duties, one script, because both are "the install did not

5 * leave this tree runnable" problems and npm's lifecycle gives us one hook:

6 *

7 * 1. Fetch the Electron runtime. Since Electron 42 the `electron` package has

8 * no postinstall that downloads the binary, and `electron-vite`'s bytecode

9 * step spawns the binary straight from `dist/` rather than through

10 * `require("electron")` (the one call that would fetch it on demand). So

11

out/renderer/assets/schedules-page-CbOATI1U.jsView file

Lines 1-33javascript

1import{r as p,h as Ni,j as u,i as Ai,k as Cu,s as Zs,f as ns,e as ae,l as Su,b as Mt,m as le,n as Ie,o as Js,p

out/renderer/assets/index-BDPyvriR.jsView file

•path = out/renderer/assets/index-BDPyvriR.js kind = oversized_source_file sizeBytes = 5871583 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-BDPyvriR.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg