Loading npm security reports…

local-operator-ui@0.32.0: Suspicious npm security report (Warn) | LPM Firewall

registry / local-operator-ui / 0.32.0

local-operator-ui@0.32.0

User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed attack was identified in the inspected source. Lifecycle operations support Electron installation, and the flagged renderer locations implement ordinary UI behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation runs Electron setup; explicit application launch activates the desktop runtime.

Impact

No malicious data export or foreign agent control-surface mutation was established.

Mechanism

Inspected commands handle runtime setup, environment loading, and backend communication; no concrete malicious chain was established.

AI rationale

The inspected source supports package-aligned Electron setup and desktop application behavior, while the Unicode and agent-configuration hints resolve to UI formatting and filename ranking. Scanner labels do not establish malicious behavior, and no concrete attack chain was found.

Decision evidence

public snapshot

AI called this Clean at 85.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

package.json invokes bin/postinstall.js, which fetches the package's Electron runtime; runtime dependencies contain no self-dependency.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

4318}, L4319: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4320: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4318

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1184: // The remaining gated legacy writes and reads the renderer still issued as L1185: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1186: // through the main-process relay, so in managed mode these went out with no ... L3617: try { L3618: text = fs.readFileSync(file, "utf8"); L3619: } catch {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

out/renderer/assets/index-C024E3U7.jsView file

506`}return t},Ive=(e,t=1.5)=>{const n=q8[e];if(n)return n;const r=z8[e];if(!r)throw new Error(`Missing icon data for ${e}`);return`<svg xmlns="http://www.w3.org/2000/svg" class="ag-i... L507: If you want to hide the page size selector, set paginationPageSizeSelector to false.`}},pivotMode:{dependencies:{treeData:{required:[!1,void 0],reason:"Pivot Mode is not supported ... L508:

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/renderer/assets/index-C024E3U7.jsView on unpkg · L506

bin/postinstall.jsView file

9* step spawns the binary straight from `dist/` rather than through L10: * `require("electron")` (the one call that would fetch it on demand). So L11: * without this, a fresh clone or a cold CI runner fails its first

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L9

out/renderer/assets/schedules-page-BkDhaIK1.jsView file

13contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},ur=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-BkDhaIK1.jsView on unpkg · L13

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 46-86json

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "app:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless electron . --window-mode=headless",

54 "//app:headless": "The agent-driven launch, so it carries the notification kill switch (scripts/notifications-off.mjs) AND the telemetry switch (scripts/telemetry-off.mjs). `headless` silences this app's OWN banner and cannot reach the backend's: the app spawns a backend, and that backend's parked-gate announcement ends at `osascript` on macOS, whose banner lands in the operator's real Notification Center attributed to Script Editor. The telemetry switch matters because a run of this line boots the real app against the live PostHog project key its build carries, in BOTH processes - main co ...

55 "//dev": "The `.env` loader is `dotenv-cli`, whose default is NOT to overwrite a variable that is already in the environment - and that non-override is load-bearing rather than incidental. `dev` used to be `npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'`, added so a checkout's `.env` would beat variables a Cursor/vscode terminal injects; that inner re-export runs AFTER any prefix the caller put on the line, so `pnpm dev:headless` (whose whole guarantee is the launch-side switch) could be re-armed by a `.env` line reading LOCAL_OPERATOR_UI_TELEM ...

56 "dev": "npx dotenv-cli -e .env -- electron-vite dev",

57 "//dev:headless": "The env var is the only channel this launch can carry a mode on. electron-vite dev spawns Electron itself from its OWN option parser and forwards nothing extra: measured, neither an appended argument nor its shipped ELECTRON_CLI_ARGS passthrough reaches the app's argv (the run reported the default 1380x900 when the passthrough asked for 1024x768). It does not need the flag: a second launch forwards the mode it resolved to the instance holding the lock (src/main/window-raise.ts), which is the channel this env var already feeds.",

58 "dev:headless": "LOCAL_OPERATOR_NO_NOTIFICATIONS=1 LOCAL_OPERATOR_UI_TELEMETRY=off LOCAL_OPERATOR_UI_WINDOW_MODE=headless pnpm dev",

59 "build": "electron-vite build",

60 "//prebuild": "The build compiles main/preload to V8 bytecode for the pinned Electron, so it needs a real node_modules/electron/dist before electron-vite runs. Since Electron 42 nothing fetches that during an install except our own postinstall, so this hook covers the trees that hook cannot reach (--ignore-scripts, or a dist/ removed by hand) and fails the build by name instead of letting it die inside the bytecode step with an ENOENT. build:npm needs no runtime: it deliberately emits plain JS (LOCAL_OPERATOR_UI_NO_BYTECODE=true).",

61 "prebuild": "node ./bin/ensure-electron.js",

62 "prebuild:npm": "rm -rf out/main out/preload",

63 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

64 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

65 "postbuild": "chmod +x ./bin/local-operator-ui.js",

66 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 "//prepare": "Wires this clone's pushes through the tracked .githooks/pre-push, so a worktree that would otherwise push ungated is either gated or refused loudly - git skips a hook file that is not there, in silence, which is exactly the state a fresh worktree is in. Not bin/postinstall.js, whose own contract is that it must never fail the install: a wiring that cannot be verified has to say so rather than report a success. Runs on `pnpm install` in a checkout and on a git-based install, and never for a published tarball's consumer, which has no repository to wire. pnpm hooks:install is th ...

68 "//prepare:evidence-fold": "Wires the clone merge driver for docs/evidence/manifest.json, so `git merge` does not stop on a manifest a sibling lane also rewrote. It runs from `prepare` for the same reason the hooks wiring does: a fresh clone (and every worktree of it, since the config is the clone LOCAL one) would otherwise fold with the driver missing, and the failure that produces is a conflict nobody knows to expect. Same contract as the hooks wiring - it fails loudly by hand and never fails the install, where `postinstall` owns the opposite rule. pnpm evidence:fold:install and pnpm evi ...

69 "prepare": "node scripts/hooks-install.mjs --tolerate-failure && node scripts/evidence-fold.mjs --install --tolerate-failure",

70 "//hooks:install": "Idempotent, and safe to run at any time: it repoints core.hooksPath at <common git dir>/lop-hooks, whose pre-push runs the gate THE CURRENT WORKTREE carries. The directory lives in the clone's shared git directory and the path is absolute because a relative core.hooksPath is resolved against the working directory and a path that does not resolve is skipped by git without a word - which is how a worktree pushed ungated while reporting no problem.",

71 "hooks:install": "node scripts/hooks-install.mjs",

72 "hooks:check": "node scripts/hooks-install.mjs --check",

73 "//evidence:fold": "Completes an evidence fold: resolves docs/evidence/manifest.json across a merge a FIELD at a time (not whole-file, and not per entry), re-derives the counts from the merged tree, runs the real guards over the result and stages it - so a fold is ONE commit that carries correct values instead of a merge plus a hand re-lay. Reads the three sides from GIT OBJECTS, so it works on a conflicted working file too. It never weakens a guard - every field the manifest still claims about its tree is written by this tool and then checked by the real guards - and a fold that moved onl ...

74 "evidence:fold": "node scripts/evidence-fold.mjs",

75 "evidence:fold:install": "node scripts/evidence-fold.mjs --install",

76 "evidence:fold:check": "node scripts/evidence-fold.mjs --check",

77 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

78 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

79 "//lint:scripts": "`pnpm lint` names the paths it checks by hand, so the whole of `scripts/` - the proof harnesses, evidence rigs and release gates - sat outside the lint and formatter contracts, and a formatter error rode into a merged pull request green. This gate runs the same `biome check` over the `scripts/` files a change touches against a base ref (`origin/main` locally, the merge commit's first parent in CI), so a violation cannot ride in with the diff that introduces it, while the tree's 106 pre-existing offenders are burnt down file by file rather than turned red at once. Widenin ...

80 "lint:scripts": "node scripts/check-scripts-lint.mjs",

81 "format": "pnpm biome format src",

82 "format:fix": "pnpm biome format --write src",

83 "prepack": "pnpm run build:npm",

84 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

85 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

86 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

Long lines were clipped for display.

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

4318}, L4319: // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the L4320: // script text carries no path and no number that a process listing of it

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L4318

•command output transform/external POST = in/python3"\n "/usr/bin/python3"\n # from environment variable (set by the installer)\n "${electron_resource_path:-}/python/bin/python3"\n # development paths\n "$(dirname "$0")/../../../resources/python/bin/python3"\n "$(pwd)/resources/python/bin/python3"\n )\n\n # ...and then whatever `path` offers, which is the half this probe used to\n # ignore entirely.\n #\n # why it matters, stated as the user story rather than as a rule: python 3.12\n # on linux usually arrives from a version manager (pyenv, mise, asdf, uv) or a\n # homebrew/linuxbrew prefix, and every one of those puts its interpreter\n # somewhere this list does not name while putting it on `path`. the list above\n # is what the app\'s own ci runner has (ubuntu\'

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

9const zod = require("zod"); L10: const node_child_process = require("node:child_process"); L11: const node_crypto = require("node:crypto"); ... L1184: // The remaining gated legacy writes and reads the renderer still issued as L1185: // bare same-origin `fetch`. `apiConfig.baseUrl` points AT THE BACKEND, not L1186: // through the main-process relay, so in managed mode these went out with no ... L3617: try { L3618: text = fs.readFileSync(file, "utf8"); L3619: } catch {

out/renderer/assets/index-C024E3U7.jsView file

506`}return t},Ive=(e,t=1.5)=>{const n=q8[e];if(n)return n;const r=z8[e];if(!r)throw new Error(`Missing icon data for ${e}`);return`<svg xmlns="http://www.w3.org/2000/svg" class="ag-i... L507: If you want to hide the page size selector, set paginationPageSizeSelector to false.`}},pivotMode:{dependencies:{treeData:{required:[!1,void 0],reason:"Pivot Mode is not supported ... L508:

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/renderer/assets/index-C024E3U7.jsView on unpkg · L506

bin/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Two install-time duties, one script, because both are "the install did not

5 * leave this tree runnable" problems and npm's lifecycle gives us one hook:

6 *

7 * 1. Fetch the Electron runtime. Since Electron 42 the `electron` package has

8 * no postinstall that downloads the binary, and `electron-vite`'s bytecode

9 * step spawns the binary straight from `dist/` rather than through

10 * `require("electron")` (the one call that would fetch it on demand). So

11

out/renderer/assets/schedules-page-BkDhaIK1.jsView file

Lines 1-33javascript

1import{r as p,h as Ni,j as u,i as Ai,k as Cu,s as Zs,f as ns,e as ae,l as Su,b as Mt,m as le,n as Ie,o as Js,p

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg