mvframe@1.1.39: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mvframe@1.1.39: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

scripts/copy-flag-assets.jsView file

6L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

scripts/scaffold-app.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: * --force, -f 覆盖已存在的脚手架文件 L13: * --no-package-json, -n 不读不写 package.json（仅生成源码与 Vite 配置） L14: */ ... L17: const path = require("path"); L18: const { execFileSync } = require("child_process"); L19: const { upsertCodexAgents } = require("./install-codex-agents.js"); ... L27: const target = path.resolve( L28: process.env.MVFRAME_SCAFFOLD_TARGET || argPath || process.cwd(), L29: ); ... L92: const TEST_DINGTALK_WEBHOOK = L93: "https://oapi.dingtalk.com/robot/send?access_token=[redacted]"; L94: const TEST_DINGTALK_SECRET =

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/scaffold-app.jsView on unpkg · L12

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg

Source & flagged code

5 flagged

scripts/copy-flag-assets.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Copy flag-icons SVG assets beside the built host bundle.

4 * `src/style/chip/flag-icons.scss` points CSS URLs at `/assets/flags/...`.

5 */

6

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

9const { createRequire } = require("module");

10const { execFileSync } = require("child_process");

11

12const root = path.resolve(__dirname, "..");

13const pnpPath = path.join(root, ".pnp.cjs");

14

15// A raw `file:` install can copy the source checkout's PnP loader into the

16// host package. Only activate it while commands are running in this checkout.

17if (path.resolve(process.cwd()) === root && fs.existsSync(pnpPath)) {

18 require(pnpPath).setup();

19}

20

21const projectRequire = createRequire(path.join(root, "package.json"));

22const flagPackagePath = projectRequire.resolve("flag-icons/package.json");

23const flagRoot = path.dirname(flagPackagePath);

24const src = path.join(flagRoot, "flags");

25const dest = path.join(root, "dist", "assets", "flags");

26

scripts/scaffold-app.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 在目标工程生成 MVFrame 推荐目录与雏形文件（views / component / api / pinia / router / config / assets）。

4 *

5 * 用法：

6 * node path/to/mvframe/scripts/scaffold-app.js [项目根] [--force|-f]

7 * yarn exec mvframe-init-app

8 *

9 * 环境变量：MVFRAME_SCAFFOLD_TARGET=/path/to/project

10 *

11 * 选项：

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg