machine-bridge-mcp@1.2.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

machine-bridge-mcp@1.2.11: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

scripts/github-backlog.mjsView file

2L3: import { spawnSync } from "node:child_process"; L4: import { dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/github-backlog.mjsView on unpkg · L2

src/local/cli-local-admin.mjsView file

292: process.platform === "win32" L293: ? { file: "cmd.exe", args: ["/d", "/s", "/c", "start", "", target] } L294: : { file: "xdg-open", args: [target] };

High

Shell

Package source references shell execution.

src/local/cli-local-admin.mjsView on unpkg · L292

scripts/release-acceptance.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = machine-bridge-mcp@1.2.9 matchedIdentity = npm:bWFjaGluZS1icmlkZ2UtbWNw:1.2.9 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/release-acceptance.mjsView on unpkg

8import { join } from "node:path"; L9: import { spawnSync } from "node:child_process"; L10: import { readBoundedRegularFileSync } from "../src/local/secure-file.mjs"; ... L34: export function packProject(root, destination) { L35: const npmCli = process.env.npm_execpath; L36: if (!npmCli) { ... L54: if (result.status !== 0) { L55: throw new Error(`npm pack failed: ${String(result.stderr || result.stdout).trim()}`); L56: } ... L58: try { L59: value = JSON.parse(result.stdout); L60: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/release-acceptance.mjsView on unpkg · L8

scripts/prepare-pinned-npm.mjsView file

1import { spawnSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L7: const NPM_VERSION = "12.0.1"; L8: const NPM_TARBALL_URL = "https://registry.npmjs.org/npm/-/npm-12.0.1.tgz"; L9: const NPM_TARBALL_INTEGRITY = "sha512-[redacted]=="; ... L11: L12: const githubPath = process.env.GITHUB_PATH; L13: if (!githubPath) throw new Error("GITHUB_PATH is required; this bootstrap is intended for GitHub Actions");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/prepare-pinned-npm.mjsView on unpkg · L1

src/local/full-access-test.mjsView file

22const keyPath = join(root, "ssh", "operator-ed25519"); L23: const authorizedKeysPath = join(root, "authorized_keys"); L24: const mainMarker = join(root, "managed-main.txt"); ... L27: const sentinelKey = `MBM_FULL_TEST_${Date.now()}`; L28: const previousSentinel = process.env[sentinelKey]; L29: process.env[sentinelKey] = "visible"; ... L57: const direct = await runtime.runDirectProcess({ L58: argv: [process.execPath, "-e", "process.stdout.write(process.cwd())"], L59: cwd: outsideDir, ... L69: L70: const shellCommand = process.platform === "win32" ? "[Console]::Out.Write('full-shell')" : "printf full-shell"; L71: const shell = await runtime.execCommand(shellCommand, 10);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/local/full-access-test.mjsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> bin/machine-mcp.mjs -> src/local/cli.mjs -> src/local/full-access-test.mjs L22: const keyPath = join(root, "ssh", "operator-ed25519"); L23: const authorizedKeysPath = join(root, "authorized_keys"); L24: const mainMarker = join(root, "managed-main.txt"); ... L27: const sentinelKey = `MBM_FULL_TEST_${Date.now()}`; L28: const previousSentinel = process.env[sentinelKey]; L29: process.env[sentinelKey] = "visible"; ... L57: const direct = await runtime.runDirectProcess({ L58: argv: [process.execPath, "-e", "process.stdout.write(process.cwd())"], L59: cwd: outsideDir, ... L69: L70: const shellCommand = process.platform === "win32" ? "[Console]::Out.Write('full-shell')" : "printf full-shell"; L71: const shell = await runtime.execCommand(shellCommand, 10);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/local/full-access-test.mjsView on unpkg · L22

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg

Source & flagged code

8 flagged

scripts/github-backlog.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3import { spawnSync } from "node:child_process";

4import { dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/github-backlog.mjsView on unpkg · L2

5import { fileURLToPath } from "node:url";

6

7const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");

8

9export function closingIssueNumbers(messages) {

10 const numbers = new Set();

11 const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?[ \t]+#(\d+)\b/gi;

12 for (const match of String(messages || "").matchAll(pattern)) numbers.add(Number(match[1]));

13 return numbers;

14}

15

16export function backlogBlockers({ issues = [], pullRequests = [], branch = "", commitMessages = "" }) {

17 const closing = closingIssueNumbers(commitMessages);

18 const issueBlockers = issues.filter((issue) => !closing.has(Number(issue.number)));

19 const pullRequestBlockers = pullRequests.filter((pull) => !(

20 String(pull.headRefName || "") === branch

21 && pull.headRepository

22 && pull.headRepository === pull.baseRepository

src/local/cli-local-admin.mjsView file

Lines 272-312javascript

272 };

273}

274

275function renderBrowserStatus(result, json) {

276 if (json) {

277 console.log(JSON.stringify(result, null

scripts/release-acceptance.mjsView file

Lines 1-28javascript

1import { createHash } from "node:crypto";

2import {

3 mkdtempSync,

4 readFileSync,

5 rmSync,

6} from "node:fs";

7import { tmpdir } from

scripts/prepare-pinned-npm.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";

4import { tmpdir } from "node:os"

src/local/full-access-test.mjsView file

Lines 2-42javascript

2import { tmpdir } from "node:os";

3import { join, resolve } from "node:path";

4import process from "node:process";

5import { createMonotonicDeadline } from "./monotonic-deadline.mjs"

mbm.cmdView file

•path = mbm.cmd kind = build_helper sizeBytes = 183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mbm.cmdView on unpkg