mergen-server: Suspicious npm security report (Warn)

Loading npm security reports…

mergen-server: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged

dist/commands/connect.jsView file

Lines 267-307javascript

267 }

268 } catch (err) {

269 console.log(`\u2717 (${err instanceof Error ? err.message : "network error"})`);

270 }

271 const teamId = (await ask(" Default team ID (Enter to pass per-request): ")).trim();

272 persistOrPrint({ LINEAR_API_KEY: apiKey, LINEAR_TEAM_ID: teamId });

273}

274async function connectEmail() {

275 console.log("");

276 log("Email connect \u2014 daily digest + weekly impact report by email", "\u2139");

277 console.log(" Email is a low-urgency digest sink. HITL approvals are NEVER delivered");

278 console.log(" by email (holds auto-deny after 15 min \u2014 use Slack for approvals).");

279 console.log("");

280 const host = (await ask(" SMTP host (smtp.yourco.com): ")).trim();

281 if (!host) {

282 log("No host entered \u2014 skipped.", "\u2139");

283 return;

284 }

285 const port = (await ask(" SMTP port (Enter for 587): ")).trim() || "587";

286 const user = (await ask(" SMTP username (Enter if none): ")).trim();

287 const pass = user ? (await ask(" SMTP password: ")).trim() : "";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/connect.jsView on unpkg · L287

288 const from = (await ask(" From address (Mergen <mergen@yourco.com>): ")).trim();

289 const to = (await ask(" Recipients, comma-separated: ")).trim();

290 if (!from || !to) {

291 log("From and recipients are required \u2014 skipped.", "\u2139");

292 return;

293 }

294 process.stdout.write(" Verifying SMTP connection... ");

295 try {

296 const { default: nodemailer } = await import("nodemailer");

297 const transporter = nodemailer.createTransport({

298 host,

299 port: Number(port),

300 secure: Number(port) === 465,

301 ...user ? { auth: { user, pass } } : {},

302 connectionTimeout: 8e3

303 });

304 await transporter.verify();

305 console.log("\u2713");

306 } catch (err) {

307 console.log(`\u2717 (${err instanceof Error ? err.message : "connection error"})`);

dist/intelligence/git-adr-sync.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import fs from "fs";

High

Child Process

Package source references child process execution.

dist/intelligence/git-adr-sync.jsView on unpkg · L1

3import path from "path";

dist/intelligence/process-tree.jsView file

Lines 1-37javascript

1import { execFile } from "child_process";

2import { promisify } from "util";

3import logger from "../sensor/logger.js";

4const execFileAsync =

dist/intelligence/impl-critic.jsView file

Lines 5-45javascript

5const SECURITY_PATTERNS = [

6 {

7 re: /catch\s*$[^)]*$\s*\{\s*\}/,

8 message: "Empty catch block silently swallows errors",

dist/intelligence/execution-mode.jsView file

Lines 1-38javascript

1function isAutopilotEnabled() {

2 return process.env.MERGEN_AUTOPILOT === "true";

4function isShadowMode() {

5 const shadowEnv

dist/commands/setup.jsView file

Lines 1-21javascript

1import { execSync, spawn, spawnSync } from "child_process";

2import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs";

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/commands/setup.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup.jsView on unpkg · L1

dist/intelligence/shadow-digest-cron.jsView file

2import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

2Trigger-reachable chain: scripts.start -> dist/index.js -> dist/intelligence/shadow-digest-cron.js L2: import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

2Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/intelligence/shadow-digest-cron.js L2: import logger from "../sensor/logger.js"; L3: const SYSTEM_TENANT = process.env.MERGEN_SYSTEM_TENANT_ID; L4: const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3; ... L28: try { L29: const res = await fetch("https://slack.com/api/chat.postMessage", { L30: method: "POST", ... L34: }, L35: body: JSON.stringify({ channel, blocks }) L36: }); ... L40: } L41: const json = await res.json(); L42: if (!json.ok) {

dist/routes/device-auth-stub.jsView file

•Manifest-reachable source serializes caller or host-sensitive data to a package-embedded authenticated webhook. dist/routes/device-auth-stub.js: webhookUrl: `https://discord.[redacted]-${randomBytes(8).toString("hex")}`, var r=await fetch('/v1/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/github/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/slack/device/approve',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({user_code:code,approve:approve})}); var r=await fetch('/v1/${id}/device/approve',{method:'POST',headers:{'content-type':'application/json

High

Fixed Authenticated Webhook Data Exfiltration

Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.

dist/routes/device-auth-stub.jsView on unpkg

dist/intelligence/enterprise-policy-engine.jsView file

3import os from "os"; L4: import { execFileSync } from "child_process"; L5: import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto"; ... L267: "gnupg", L268: // ' .env' catches a cwd-relative `cat .env`; '/.env' catches a path- L269: // qualified reference (`cat ~/.env`, `cat some/dir/.env`) that the ... L325: function _allowUnsignedPolicy() { L326: return process.env.MERGEN_ALLOW_UNSIGNED_POLICY === "true"; L327: } ... L359: const expected = _signPolicyPayload(raw, secret); L360: const storedBuf = Buffer.from(storedSig, "hex"); L361: const expectBuf = Buffer.from(expected, "hex");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/intelligence/enterprise-policy-engine.jsView on unpkg · L3

dist/commands/incident.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/incident.js#virtual:normalized:round1View on unpkg

Source & flagged code

21 flagged · loading source

dist/commands/connect.jsView file

287patternName = generic_password severity = medium line = 287

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/connect.jsView on unpkg · L287

dist/intelligence/git-adr-sync.jsView file

1import { execSync } from "child_process"; L2: import fs from "fs";

High

Child Process

Package source references child process execution.

dist/intelligence/git-adr-sync.jsView on unpkg · L1

dist/intelligence/process-tree.jsView file

17async function listAllProcessesWindows() { L18: const { stdout } = await execFileAsync("powershell", [ L19: "-NoProfile",

High

Shell

Package source references shell execution.

dist/intelligence/process-tree.jsView on unpkg · L17

dist/intelligence/impl-critic.jsView file

25re: /eval\s*\(/, L26: message: "eval() is forbidden \u2014 arbitrary code execution risk", L27: suggestion: "Remove eval(). Use explicit logic or JSON.parse for data.",

High

Eval

Package source references dynamic code evaluation.

dist/intelligence/impl-critic.jsView on unpkg · L25

dist/intelligence/execution-mode.jsView file

20try { L21: const { isOnboardingObservationMode } = require("../sensor/onboarding-window.js"); L22: return isOnboardingObservationMode();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/intelligence/execution-mode.jsView on unpkg · L20

dist/commands/setup.jsView file

1Source sends the broad process environment to a literal external destination. L1: import { execSync, spawn, spawnSync } from "child_process"; L2: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs"; ... L31: function currentWorkspaceLedgerDb() { L32: return path.join(workspaceStoreDir(process.cwd()), "action-ledger.db"); L33: } ... L87: const { cfg } = await import("../config/config.js"); L88: const apiUrl = (cfg("MERGEN_API_URL").value ?? "https://api.mergen.app").replace(/\/+$/, ""); L89: await enrollRuntimeCredential(apiUrl, licenseKey, getInstallId(), process.platform); L90: } catch { ... L109: } L110: const apiUrl = process.env.MERGEN_API_URL ?? "https://api.mergen.app"; L111: console.log("\u{1F680} Signing in to Mergen...\n");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/commands/setup.jsView on unpkg · L1

955console.log("\u{1F916} Mergen CI health check\n"); L956: const proc = spawn("node", [serverPath], { L957: stdio: "pipe", L958: env: { ...process.env, NODE_ENV: "production", MERGEN_PORT: "3099" } L959: }); L960: const stopForwarding = forwardSignalsTo(proc); L961: const BASE = "http://127.0.0.1:3099"; L962: let serverReady = false;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/setup.jsView on unpkg · L955

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/commands/setup.js: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs"; const { runDeviceAuthorization, DeviceAuthError } = await import("../intelligence/device-auth.js"); const activation = await runDeviceAuthorization(apiUrl, { writeFileSync(terminalModeFile, `${(/* @__PURE__ */ new Date()).toISOString()} writeFileSync(rcPath, `${existing}${existing === "" || existing.endsWith("\n") ? "" : "\n"}eval "$(mergen shell-init ${completionShell})" writeFileSync(SECRET_FILE, secret, { encoding: "utf8", mode: 384 }); const { createInterface: createInterface2 } = await import("readline"); writeFileS

dist/intelligence/shadow-digest-cron.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

dist/routes/device-auth-stub.jsView file

High

Fixed Authenticated Webhook Data Exfiltration

Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.

dist/routes/device-auth-stub.jsView on unpkg

dist/intelligence/enterprise-policy-engine.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/intelligence/enterprise-policy-engine.jsView on unpkg · L3

dist/commands/incident.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/incident.js#virtual:normalized:round1View on unpkg

Source & flagged code

21 flagged

dist/commands/connect.jsView file

Lines 267-307javascript

267 }

268 } catch (err) {

269 console.log(`\u2717 (${err instanceof Error ? err.message : "network error"})`);

270 }

271 const teamId = (await ask(" Default team ID (Enter to pass per-request): ")).trim();

272 persistOrPrint({ LINEAR_API_KEY: apiKey, LINEAR_TEAM_ID: teamId });

273}

274async function connectEmail() {

275 console.log("");

276 log("Email connect \u2014 daily digest + weekly impact report by email", "\u2139");

277 console.log(" Email is a low-urgency digest sink. HITL approvals are NEVER delivered");

278 console.log(" by email (holds auto-deny after 15 min \u2014 use Slack for approvals).");

279 console.log("");

280 const host = (await ask(" SMTP host (smtp.yourco.com): ")).trim();

281 if (!host) {

282 log("No host entered \u2014 skipped.", "\u2139");

283 return;

284 }

285 const port = (await ask(" SMTP port (Enter for 587): ")).trim() || "587";

286 const user = (await ask(" SMTP username (Enter if none): ")).trim();

287 const pass = user ? (await ask(" SMTP password: ")).trim() : "";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/connect.jsView on unpkg · L287

288 const from = (await ask(" From address (Mergen <mergen@yourco.com>): ")).trim();

289 const to = (await ask(" Recipients, comma-separated: ")).trim();

290 if (!from || !to) {

291 log("From and recipients are required \u2014 skipped.", "\u2139");

292 return;

293 }

294 process.stdout.write(" Verifying SMTP connection... ");

295 try {

296 const { default: nodemailer } = await import("nodemailer");

297 const transporter = nodemailer.createTransport({

298 host,

299 port: Number(port),

300 secure: Number(port) === 465,

301 ...user ? { auth: { user, pass } } : {},

302 connectionTimeout: 8e3

303 });

304 await transporter.verify();

305 console.log("\u2713");

306 } catch (err) {

307 console.log(`\u2717 (${err instanceof Error ? err.message : "connection error"})`);

dist/intelligence/git-adr-sync.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import fs from "fs";

High

Child Process

Package source references child process execution.

dist/intelligence/git-adr-sync.jsView on unpkg · L1

3import path from "path";

dist/intelligence/process-tree.jsView file

Lines 1-37javascript

1import { execFile } from "child_process";

2import { promisify } from "util";

3import logger from "../sensor/logger.js";

4const execFileAsync =

dist/intelligence/impl-critic.jsView file

Lines 5-45javascript

5const SECURITY_PATTERNS = [

6 {

7 re: /catch\s*$[^)]*$\s*\{\s*\}/,

8 message: "Empty catch block silently swallows errors",

dist/intelligence/execution-mode.jsView file

Lines 1-38javascript

1function isAutopilotEnabled() {

2 return process.env.MERGEN_AUTOPILOT === "true";

4function isShadowMode() {

5 const shadowEnv

dist/commands/setup.jsView file

Lines 1-21javascript

1import { execSync, spawn, spawnSync } from "child_process";

2import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync, renameSync } from "fs";

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/commands/setup.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup.jsView on unpkg · L1

dist/intelligence/shadow-digest-cron.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/intelligence/shadow-digest-cron.jsView on unpkg · L2

dist/routes/device-auth-stub.jsView file

High

Fixed Authenticated Webhook Data Exfiltration

Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.

dist/routes/device-auth-stub.jsView on unpkg

dist/intelligence/enterprise-policy-engine.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/intelligence/enterprise-policy-engine.jsView on unpkg · L3

dist/commands/incident.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/incident.js#virtual:normalized:round1View on unpkg

mergen-server@1.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code