Loading npm security reports…

local-operator-ui@0.31.32: Suspicious npm security report (Warn) | LPM Firewall

registry / local-operator-ui / 0.31.32

local-operator-ui@0.31.32

User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed attack was identified. Inspected lifecycle and runtime behavior supports the Electron application and its backend.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installation performs Electron setup; explicit application launch activates runtime functionality.

Impact

No malicious data transfer or agent control mutation was established.

Mechanism

Package-local runtime installation, guarded sandbox repair, backend communication, and date formatting explain the inspected findings.

AI rationale

Inspected source supports ordinary application setup and operation, including guarded sandbox permission repair. Scanner claims of command-output exfiltration and Trojan Source behavior were not substantiated by the inspected executable behavior.

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

The postinstall hook invokes package-local Electron setup; inspected code downloads its runtime and repairs its sandbox helper.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

4294}, L4295: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4296: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4294

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1183: // The remaining gated legacy writes and reads the renderer still issued as L1184: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1185: // through the main-process relay, so in managed mode these went out with no ... L3593: try { L3594: text = fs.readFileSync(file, "utf8"); L3595: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

out/renderer/assets/index-QVureTEn.jsView file

501`}return t},fve=(e,t=1.5)=>{const n=L8[e];if(n)return n;const r=O8[e];if(!r)throw new Error(`Missing icon data for ${e}`);return`<svg xmlns="http://www.w3.org/2000/svg" class="ag-i... L502: If you want to hide the page size selector, set paginationPageSizeSelector to false.`}},pivotMode:{dependencies:{treeData:{required:[!1,void 0],reason:"Pivot Mode is not supported ... L503:

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/renderer/assets/index-QVureTEn.jsView on unpkg · L501

bin/postinstall.jsView file

9* step spawns the binary straight from `dist/` rather than through L10: * `require("electron")` (the one call that would fetch it on demand). So L11: * without this, a fresh clone or a cold CI runner fails its first

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L9

out/renderer/assets/schedules-page-OVNdDci6.jsView file

13contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},ur=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-OVNdDci6.jsView on unpkg · L13

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 46-86json

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "app:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless electron . --window-mode=headless",

54 "//app:headless": "The agent-driven launch, so it carries the notification kill switch (scripts/notifications-off.mjs) AND the telemetry switch (scripts/telemetry-off.mjs). `headless` silences this app's OWN banner and cannot reach the backend's: the app spawns a backend, and that backend's parked-gate announcement ends at `osascript` on macOS, whose banner lands in the operator's real Notification Center attributed to Script Editor. The telemetry switch matters because a run of this line boots the real app against the live PostHog project key its build carries, in BOTH processes - main co ...

55 "//dev": "The `.env` loader is `dotenv-cli`, whose default is NOT to overwrite a variable that is already in the environment - and that non-override is load-bearing rather than incidental. `dev` used to be `npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'`, added so a checkout's `.env` would beat variables a Cursor/vscode terminal injects; that inner re-export runs AFTER any prefix the caller put on the line, so `pnpm dev:headless` (whose whole guarantee is the launch-side switch) could be re-armed by a `.env` line reading LOCAL_OPERATOR_UI_TELEM ...

56 "dev": "npx dotenv-cli -e .env -- electron-vite dev",

57 "//dev:headless": "The env var is the only channel this launch can carry a mode on. electron-vite dev spawns Electron itself from its OWN option parser and forwards nothing extra: measured, neither an appended argument nor its shipped ELECTRON_CLI_ARGS passthrough reaches the app's argv (the run reported the default 1380x900 when the passthrough asked for 1024x768). It does not need the flag: a second launch forwards the mode it resolved to the instance holding the lock (src/main/window-raise.ts), which is the channel this env var already feeds.",

58 "dev:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless pnpm dev",

59 "build": "electron-vite build",

60 "//prebuild": "The build compiles main/preload to V8 bytecode for the pinned Electron, so it needs a real node_modules/electron/dist before electron-vite runs. Since Electron 42 nothing fetches that during an install except our own postinstall, so this hook covers the trees that hook cannot reach (--ignore-scripts, or a dist/ removed by hand) and fails the build by name instead of letting it die inside the bytecode step with an ENOENT. build:npm needs no runtime: it deliberately emits plain JS (LOCAL_OPERATOR_UI_NO_BYTECODE=true).",

61 "prebuild": "node ./bin/ensure-electron.js",

62 "prebuild:npm": "rm -rf out/main out/preload",

63 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

64 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

65 "postbuild": "chmod +x ./bin/local-operator-ui.js",

66 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "//prepare": "Wires this clone's pushes through the tracked .githooks/pre-push, so a worktree that would otherwise push ungated is either gated or refused loudly - git skips a hook file that is not there, in silence, which is exactly the state a fresh worktree is in. Not bin/postinstall.js, whose own contract is that it must never fail the install: a wiring that cannot be verified has to say so rather than report a success. Runs on `pnpm install` in a checkout and on a git-based install, and never for a published tarball's consumer, which has no repository to wire. pnpm hooks:install is th ...

68 "//prepare:evidence-fold": "Wires the clone merge driver for docs/evidence/manifest.json, so `git merge` does not stop on a fold manifest conflict. It runs from `prepare` for the same reason the hooks wiring does: a fresh clone (and every worktree of it, since the config is the clone LOCAL one) would otherwise fold with the driver missing, and the failure that produces is a conflict nobody knows to expect. Same contract as the hooks wiring - it fails loudly by hand and never fails the install, where `postinstall` owns the opposite rule. pnpm evidence:fold:install and pnpm evidence:fold:che ...

69 "prepare": "node scripts/hooks-install.mjs --tolerate-failure && node scripts/evidence-fold.mjs --install --tolerate-failure",

70 "//hooks:install": "Idempotent, and safe to run at any time: it repoints core.hooksPath at <common git dir>/lop-hooks, whose pre-push runs the gate THE CURRENT WORKTREE carries. The directory lives in the clone's shared git directory and the path is absolute because a relative core.hooksPath is resolved against the working directory and a path that does not resolve is skipped by git without a word - which is how a worktree pushed ungated while reporting no problem.",

71 "hooks:install": "node scripts/hooks-install.mjs",

72 "hooks:check": "node scripts/hooks-install.mjs --check",

73 "//evidence:fold": "Completes an evidence fold: resolves docs/evidence/manifest.json across a merge a FIELD at a time (not whole-file, and not per entry), re-derives the stamps and counts from the merged tree, runs the real guards over the result and stages it - so a fold is ONE commit that carries correct values instead of a merge plus a hand re-lay. Reads the three sides from GIT OBJECTS, so it works on a conflicted working file too. It never weakens a guard: the stamps stay stored and the shipped-versus-HEAD comparison is unchanged. pnpm evidence:fold:install wires the clone merge drive ...

74 "evidence:fold": "node scripts/evidence-fold.mjs",

75 "evidence:fold:install": "node scripts/evidence-fold.mjs --install",

76 "evidence:fold:check": "node scripts/evidence-fold.mjs --check",

77 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

78 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

79 "//lint:scripts": "`pnpm lint` names the paths it checks by hand, so the whole of `scripts/` - the proof harnesses, evidence rigs and release gates - sat outside the lint and formatter contracts, and a formatter error rode into a merged pull request green. This gate runs the same `biome check` over the `scripts/` files a change touches against a base ref (`origin/main` locally, the merge commit's first parent in CI), so a violation cannot ride in with the diff that introduces it, while the tree's 106 pre-existing offenders are burnt down file by file rather than turned red at once. Widenin ...

80 "lint:scripts": "node scripts/check-scripts-lint.mjs",

81 "format": "pnpm biome format src",

82 "format:fix": "pnpm biome format --write src",

83 "prepack": "pnpm run build:npm",

84 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

85 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

86 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

Long lines were clipped for display.

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

4294}, L4295: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4296: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4294

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1183: // The remaining gated legacy writes and reads the renderer still issued as L1184: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1185: // through the main-process relay, so in managed mode these went out with no ... L3593: try { L3594: text = fs.readFileSync(file, "utf8"); L3595: } catch {

out/renderer/assets/index-QVureTEn.jsView file

501`}return t},fve=(e,t=1.5)=>{const n=L8[e];if(n)return n;const r=O8[e];if(!r)throw new Error(`Missing icon data for ${e}`);return`<svg xmlns="http://www.w3.org/2000/svg" class="ag-i... L502: If you want to hide the page size selector, set paginationPageSizeSelector to false.`}},pivotMode:{dependencies:{treeData:{required:[!1,void 0],reason:"Pivot Mode is not supported ... L503:

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/renderer/assets/index-QVureTEn.jsView on unpkg · L501

bin/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Two install-time duties, one script, because both are "the install did not

5 * leave this tree runnable" problems and npm's lifecycle gives us one hook:

6 *

7 * 1. Fetch the Electron runtime. Since Electron 42 the `electron` package has

8 * no postinstall that downloads the binary, and `electron-vite`'s bytecode

9 * step spawns the binary straight from `dist/` rather than through

10 * `require("electron")` (the one call that would fetch it on demand). So

11

out/renderer/assets/schedules-page-OVNdDci6.jsView file

Lines 1-33javascript

1import{r as p,h as Ni,j as u,i as Ai,k as Cu,s as Zs,f as ns,e as ae,l as Su,b as Mt,m as le,n as Ie,o as Js,p

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg