murasaki: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

murasaki: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/cli/node-runtime.jsView file

4import { join } from 'node:path'; L5: import { spawnSync } from 'node:child_process'; L6: import { readCleartextMessage, readKey, verify } from 'openpgp';

High

Child Process

Package source references child process execution.

dist/cli/node-runtime.jsView on unpkg · L4

dist/cli/bundle.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = murasaki@0.54.0 matchedIdentity = npm:bXVyYXNha2k:0.54.0 similarity = 0.652 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/bundle.jsView on unpkg

565* dependency: the posix `zip` CLI ships on every GitHub Actions macOS/Linux L566: * runner (and this repo's dev machines), and PowerShell's `Compress-Archive` L567: * ships with every Windows runner/install — between the two, this covers

High

Shell

Package source references shell execution.

dist/cli/bundle.jsView on unpkg · L565

bin/murasaki.mjsView file

27L28: const mod = await import(pathToFileURL(distEntry).href) L29: if (typeof mod.default !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/murasaki.mjsView on unpkg · L27

dist/cli/installer.jsView file

4import { tmpdir } from 'node:os'; L5: import { spawnSync } from 'node:child_process'; L6: import { createHash } from 'node:crypto'; ... L14: import { writeArArchive, writeUstarTar } from './deb.js'; L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const DEFAULT_WINDOW = { width: 640, height: 420 }; ... L47: } L48: if (process.platform !== 'darwin') { L49: process.stdout.write(`\n${warn('installer: a .dmg can only be built while running on macOS (win32/Linux targets can be built from any host with the right tools installed).')}\n\n`)... L50: return; ... L268: * Apple notarization for `--notarize`, following Apple's documented flow: L269: * https://developer.apple.[redacted]-macos-software-before-distribution

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/installer.jsView on unpkg · L4

dist/cli/dev.jsView file

1Cross-file remote execution chain: dist/cli/dev.js spawns dist/runtime/window-auth.js; helper contains network access plus dynamic code execution. L1: import { spawn } from 'node:child_process'; L2: import { randomBytes } from 'node:crypto'; ... L4: import { fileURLToPath } from 'node:url'; L5: import http from 'node:http'; L6: import net from 'node:net'; ... L15: import { createWindowAuthInitScript } from '../runtime/window-auth.js'; L16: const __dirname = dirname(fileURLToPath(import.meta.url)); L17: /** ... L44: if (port !== requestedPort) { L45: process.stdout.write(`\n Port ${requestedPort} is in use — starting on ${port} instead\n`); L46: } ... L84: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/dev.jsView on unpkg · L1

Source & flagged code

6 flagged

dist/cli/node-runtime.jsView file

Lines 1-24javascript

1import { existsSync } from 'node:fs';

2import { chmod, copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';

3import { homedir, tmpdir } from 'node:os';

4import { join } from 'node:path';

5import { spawnSync } from 'node:child_process';

6import { readCleartextMessage, readKey, verify } from 'openpgp';

High

Child Process

Package source references child process execution.

dist/cli/node-runtime.jsView on unpkg · L4

7import { dim } from './brand.js';

8import { downloadHttpsFile, fetchHttpsText, sha256File } from './secure-fetch.js';

9/**

10 * Fetch, verify, and cache the official Node.js runtime for a target

11 * platform/arch/version, so `murasaki bundle` ships a portable,

12 * target-specific node — not whatever node happens to be running the CLI,

13 * which is (a) possibly the wrong platform/arch for a cross build, and (b)

14 * possibly a non-portable Homebrew/nvm build linked against libs that aren't

15 * present on other machines.

16 *

17 * Cached at `~/.murasaki/node/<version>/<platform>-<arch>/<node|node.exe>`; a

18 * second call for the same version/platform/arch returns the cached path

19 * immediately with no network access.

20 */

21export async function ensureNodeBinary(platform, arch, version) {

22 const cacheDir = join(homedir(), '.murasaki', 'node', version, `${platform}-${arch}`);

23 const binaryName = platform === 'win32' ? 'node.exe' : 'node';

24 const cachedNode = join(cacheDir, binaryName);

dist/cli/bundle.jsView file

Lines 545-585javascript

545 if (!existsSync(src)) {

546 process.stdout.write(`\n${warn(`icon: ${iconPath} not found, skipping`)}\n\n`);

547 return null

bin/murasaki.mjsView file

Lines 7-39javascript

7const __dirname = dirname(fileURLToPath(import.meta.url))

8const cmd = process.argv[2]

9

10const distEntry

dist/cli/installer.jsView file

Lines 1-24javascript

1import { resolve, join, dirname, basename } from 'node:path';

2import { existsSync } from 'node:fs';

3import { mkdtemp, rm, cp, copyFile, mkdir, symlink, writeFile, readFile, readdir, stat } from 'node:fs/promises';

4import { tmpdir } from 'node:os'

dist/cli/dev.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { randomBytes } from 'node:crypto';

3import { dirname, resolve } from 'node:path';

4import { fileURLToPath } from 'node:url';