mcp-code-worker: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mcp-code-worker: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/index.jsView file

12920import { constants as constants2 } from "fs"; L12921: import { spawn } from "child_process"; L12922: import { extname, posix as posix2, win32 as win322 } from "path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L12920

8592"sudo", L8593: "powershell", L8594: "cmd"

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8592

284data, L285: message = `Invalid response data: ${JSON.stringify(data)}.` L286: }) { ... L486: ); L487: if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.... L488: const trailing2 = processLines(chunk); ... L862: } L863: apiKey = process.env[environmentVariableName]; L864: if (apiKey == null) { ... L2159: * See: L2160: * https://github.com/colinhacks/zod/issues/2433 L2161: * Fix in Zod:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L284

dist/main.jsView file

285Cross-file remote execution chain: dist/main.js spawns dist/index.js; helper contains network access plus dynamic code execution. L285: data, L286: message = `Invalid response data: ${JSON.stringify(data)}.` L287: }) { ... L487: ); L488: if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.... L489: const trailing2 = processLines(chunk); ... L863: } L864: apiKey = process.env[environmentVariableName]; L865: if (apiKey == null) { ... L2160: * See: L2161: * https://github.com/colinhacks/zod/issues/2433 L2162: * Fix in Zod:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/main.jsView on unpkg · L285

Source & flagged code

4 flagged

dist/index.jsView file

12920import { constants as constants2 } from "fs"; L12921: import { spawn } from "child_process"; L12922: import { extname, posix as posix2, win32 as win322 } from "path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L12920

8592"sudo", L8593: "powershell", L8594: "cmd"

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8592

284data, L285: message = `Invalid response data: ${JSON.stringify(data)}.` L286: }) { ... L486: ); L487: if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.... L488: const trailing2 = processLines(chunk); ... L862: } L863: apiKey = process.env[environmentVariableName]; L864: if (apiKey == null) { ... L2159: * See: L2160: * https://github.com/colinhacks/zod/issues/2433 L2161: * Fix in Zod:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L284

dist/main.jsView file

285Cross-file remote execution chain: dist/main.js spawns dist/index.js; helper contains network access plus dynamic code execution. L285: data, L286: message = `Invalid response data: ${JSON.stringify(data)}.` L287: }) { ... L487: ); L488: if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.... L489: const trailing2 = processLines(chunk); ... L863: } L864: apiKey = process.env[environmentVariableName]; L865: if (apiKey == null) { ... L2160: * See: L2161: * https://github.com/colinhacks/zod/issues/2433 L2162: * Fix in Zod:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/main.jsView on unpkg · L285