Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

meadow-integration: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / meadow-integration / 1.1.3

meadow-integration@1.1.3

Meadow Data Integration

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A first-party Retold/Ultravisor beacon provider exposes file parsing, record transformation, and record POST actions when loaded by its host. No unconsented install-time or foreign agent-control mutation was found.

Static reason

No blocking static signals were detected.

Trigger

External beacon host loads the declared provider and invokes its actions.

Impact

Authorized host workflows can read specified data files and send supplied records to a configured beacon endpoint.

Mechanism

Host-invoked agent capability registration with caller-configured file and HTTP targets.

Rationale

This is a first-party package-owned agent extension with file/network capabilities, so it warrants a warning under policy. The inspected source does not establish malicious behavior.

Evidence

package.jsonsource/Meadow-Integration-BeaconProvider.jssource/services/clone/Meadow-Service-RestClient.jssource/cli/commands/Meadow-Integration-Command-ConvertXLSMToXLSX.js

Network endpoints1

localhost:8080/1.0/

Decision evidence

public snapshot

AI called this at 86.0% confidence with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Suspicious

as Dangerous Capability

medium

Evidence for warning

package.json declares a retoldBeacon capability provider.
Beacon provider reads a host-supplied file path and POSTs records to a host-supplied BeaconURL.

Evidence against

package.json has no preinstall/install/postinstall hook.
Provider is loaded only by an external beacon host at runtime.
Network target is supplied per work item; no hard-coded external host.
No eval/vm or stealth child-process behavior in source; spawn is an explicit LibreOffice CLI command.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 3.06 MB of source, external domains: example.com, feross.org, github.com, myapp.example.com, velozo.com, www.w3.org

Source & flagged code

5 flagged · loading source

example-applications/mapping-demo/web/pict.min.jsView file

1"use strict";function _defineProperty2(e,t,r){return(t=_toPropertyKey2(t))in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function _toP... L2: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

example-applications/mapping-demo/web/pict.min.jsView on unpkg · L1

source/Meadow-Service-Integration-Adapter.jsView file

1const libFableServiceProviderBase = require('fable-serviceproviderbase'); L2: const libGUIDMap = require('./Meadow-Service-Integration-GUIDMap.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

source/Meadow-Service-Integration-Adapter.jsView on unpkg · L1

Docker-Tag.shView file

•path = Docker-Tag.sh kind = build_helper sizeBytes = 78 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

Docker-Tag.shView on unpkg

docs/data-clone/connection-manager.mdView file

44patternName = generic_password severity = medium line = 44 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/data-clone/connection-manager.md

docs/data-clone/connection-manager.mdView on unpkg · L44

96patternName = generic_password severity = medium line = 96 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in docs/data-clone/connection-manager.md

docs/data-clone/connection-manager.mdView on unpkg · L96

Findings

8 Medium7 Low

MediumDynamic Requiresource/Meadow-Service-Integration-Adapter.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build HelperDocker-Tag.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/data-clone/connection-manager.md

MediumSecret Patterndocs/data-clone/connection-manager.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexample-applications/mapping-demo/web/pict.min.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Authorsteven velozo

Maintainersstevenvelozo, bigal

Version1.1.3

PublishedJul 10, 2026

LicenseMIT

Dependencies16

Integrityverified

Package size5.25 MB

Files265

Runtime surface

package.json

Entrypointsmain → source/Meadow-Integration.jsbin → mdwint

RuntimeNo engine / OS / CPU constraints

Artifact24.2 MB · 265 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

example-applications/mapping-demo/web/pict.min.jsView file

1"use strict";function _defineProperty2(e,t,r){return(t=_toPropertyKey2(t))in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function _toP... L2: /**

Low

Eval

Package source references a known benign dynamic code generation pattern.

example-applications/mapping-demo/web/pict.min.jsView on unpkg · L1

source/Meadow-Service-Integration-Adapter.jsView file

Lines 1-21javascript

1const libFableServiceProviderBase = require('fable-serviceproviderbase');

2const libGUIDMap = require('./Meadow-Service-Integration-GUIDMap.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

source/Meadow-Service-Integration-Adapter.jsView on unpkg · L1

3const libGUIDComposer = require('./services/guid/Meadow-Integration-GUIDComposer.js');

4

5const defaultMeadowIntegrationAdapterOptions = (

6 {

7 "Entity": "DefaultEntity",

8

9 "AdapterSetGUIDMarshalPrefix": false,

10

11 "EntityGUIDMarshalPrefix": false,

12

13 // Maximum allowed length for generated GUIDs.

14 // When 0, the adapter falls back to DefaultGUIDColumnSize.

15 // When a positive integer, this explicit value overrides everything.

16 "GUIDMaxLength": 0,

17

18 // Schema-driven per-entity GUID column sizes.

19 // Keys are entity names, values are max GUID column sizes.

20 // Pass the full map in options or let it default to empty.

21 "GUIDColumnSizes": {},

Docker-Tag.shView file

•path = Docker-Tag.sh kind = build_helper sizeBytes = 78 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

Docker-Tag.shView on unpkg

docs/data-clone/connection-manager.mdView file

Lines 24-64markdown

24| `user` | string | `"root"` | Database username |

25| `password` | string | `""` | Database password |

26| `database` | string | `"meadow"` | Database name |

27| `connectionLimit` | number | `20` | Maximum number of connections in the pool |

28

29### Example

30

31```javascript

32const meadowIntegration = require('meadow-integration');

33const libFable = require('fable');

34

35const fable = new libFable({});

36

37fable.serviceManager.addServiceType('MeadowConnectionManager', meadowIntegration.ConnectionManager);

38fable.serviceManager.instantiateServiceProvider('MeadowConnectionManager', {

39 Provider: 'MySQL',

40 MySQL: {

41 server: '127.0.0.1',

42 port: 3306,

43 user: 'app_user',

44 password: 'secure_password',

Medium

Secret Pattern

Hardcoded password in docs/data-clone/connection-manager.md

docs/data-clone/connection-manager.mdView on unpkg · L44

45 database: 'meadow_clone',

46 connectionLimit: 20

47 }

48});

49

50fable.MeadowConnectionManager.connect((pError, pConnectionPool) => {

51 if (pError) {

52 console.error('MySQL connection failed:', pError);

53 return;

54 }

55 console.log('Connected to MySQL. Pool ready.');

56 // pConnectionPool is the mysql2 pool instance

57});

58```

59

60### How MySQL Connection Works

61

621. The `meadow-connection-mysql` module is loaded dynamically.

632. The `connectionLimit` is propagated to `fable.settings` for the Meadow provider.

643. MySQL settings are applied to `fable.settings.MySQL`.

Lines 76-116markdown

76| `user` | string | `"sa"` | Database username |

77| `password` | string | `""` | Database password |

78| `database` | string | `"meadow"` | Database name |

79| `ConnectionPoolLimit` | number | `20` | Maximum number of connections in the pool |

80

81### Example

82

83```javascript

84const meadowIntegration = require('meadow-integration');

85const libFable = require('fable');

86

87const fable = new libFable({});

88

89fable.serviceManager.addServiceType('MeadowConnectionManager', meadowIntegration.ConnectionManager);

90fable.serviceManager.instantiateServiceProvider('MeadowConnectionManager', {

91 Provider: 'MSSQL',

92 MSSQL: {

93 server: 'sql-server.local',

94 port: 1433,

95 user: 'sa',

96 password: 'YourStrong!Passw0rd',

Medium

Secret Pattern

Hardcoded password in docs/data-clone/connection-manager.md

docs/data-clone/connection-manager.mdView on unpkg · L96

97 database: 'meadow_clone',

98 ConnectionPoolLimit: 20

99 }

100});

101

102fable.MeadowConnectionManager.connect((pError, pConnectionPool) => {

103 if (pError) {

104 console.error('MSSQL connection failed:', pError);

105 return;

106 }

107 console.log('Connected to MSSQL. Pool ready.');

108});

109```

110

111### How MSSQL Connection Works

112

1131. The `meadow-connection-mssql` module is loaded dynamically.

1142. MSSQL settings are applied to `fable.settings.MSSQL`.

1153. The provider is registered as `MeadowMSSQLProvider` and connected via `connectAsync`.

1164. The resulting connection pool is stored in `ConnectionManager.ConnectionPool`.