natureco-cli@5.71.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

natureco-cli@5.71.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

11L12: const { execFileSync } = require('child_process'); L13: const fs = require('fs');

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L11

src/commands/policy.jsView file

92const { execSync } = require('child_process'); L93: const output = execSync(`powershell -Command "Get-PSDrive -Name ${drive} | Select-Object -ExpandProperty Free"`, { encoding: 'utf-8' }).trim(); L94: const free = parseInt(output);

High

Shell

Package source references shell execution.

src/commands/policy.jsView on unpkg · L92

bin/natureco.jsView file

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2] === '-V')) { L6: process.stdout.write(require('../package.json').version + '\n'); L7: process.exit(0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/natureco.jsView on unpkg · L5

src/commands/gateway-server.jsView file

4const os = require('os'); L5: const { spawn, execSync, execFileSync } = require('child_process'); L6: const pino = require('pino'); ... L14: L15: const PID_FILE = path.join(os.homedir(), '.natureco', 'gateway.pid'); L16: const LOG_FILE = path.join(os.homedir(), '.natureco', 'gateway.log'); ... L71: if (!global.discordClient) throw new Error('Discord not connected'); L72: const channel = await global.discordClient.channels.fetch(String(item.target)); L73: return channel.send(String(item.payload.message)); L74: }, async () => ({ ok: !!global.discordClient })); ... L146: L147: // Note: File writing removed - parent process redirects stdout/stderr to log file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/commands/gateway-server.jsView on unpkg · L4

src/tools/cron_create.jsView file

10const os = require("os"); L11: const { execSync } = require("child_process"); L12: L13: const CRON_FILE = path.join(os.homedir(), ".natureco", "crons.json"); L14: ... L17: if (!fs.existsSync(CRON_FILE)) return []; L18: return JSON.parse(fs.readFileSync(CRON_FILE, "utf8")); L19: } catch { return []; } ... L42: L43: async function createCron({ name, schedule, command, description = "", allowSystemCrontab = false, agentId = "default" }) { L44: if (!name) return { success: false, error: "name gerekli" };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/tools/cron_create.jsView on unpkg · L10

src/tools/voice_chat.jsView file

15const path = require("path"); L16: const { spawn } = require("child_process"); L17: const https = require("https"); L18: ... L25: return new Promise((resolve, reject) => { L26: const apiKey = process.env.OPENAI_API_KEY || process.env.WHISPER_API_KEY; L27: if (!apiKey) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/tools/voice_chat.jsView on unpkg · L15

src/tools/phone_control_enhanced.jsView file

1const { getConfig, saveConfig } = require('../utils/config'); L2: const { execFileSync } = require('child_process'); L3: ... L56: if (service === 'pushover') { L57: const token = config.pushoverToken || process.env.PUSHOVER_TOKEN; L58: const user = config.pushoverUser || process.env.PUSHOVER_USER; L59: if (!token || !user) return { success: false, error: 'Pushover token/user gerekli' }; L60: const r = await fetch('https://api.pushover.net/1/messages.json', { L61: method: 'POST', L62: headers: { 'Content-Type': 'application/json' }, L63: body: JSON.stringify({ token, user, title: params.title || 'NatureCo', message: params.message, priority: params.priority || 0 }) L64: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/phone_control_enhanced.jsView on unpkg · L1

src/tools/youtube_ac.jsView file

4L5: const { spawn, execFileSync } = require("child_process"); L6: const os = require("os"); ... L30: function isUrl(str) { L31: return str.startsWith("http://") || str.startsWith("https://"); L32: } ... L64: ? spawn("open", browser ? ["-a", browser, youtubeUrl] : [youtubeUrl]) L65: : process.platform === "win32" L66: ? spawn("cmd", ["/c", "start", "", youtubeUrl], { windowsHide: true })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/update.jsView file

137try { L138: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L139: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L137

src/commands/code_v5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = natureco-cli@5.71.5 matchedIdentity = npm:bmF0dXJlY28tY2xp:5.71.5 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/code_v5.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 13-53json

13 "README.md",

14 "SELF.md",

15 "CHANGELOG.md",

16 "AUDIT.md",

17 "SECURITY_AUDIT_SUMMARY.md",

18 "THIRD_PARTY_NOTICES.md",

19 "DEPLOY_v2.0.0.md"

20 ],

21 "scripts": {

22 "test": "vitest run",

23 "test:unit": "vitest run",

24 "test:watch": "vitest",

25 "test:coverage": "vitest run --coverage",

26 "perf:startup": "node scripts/benchmark-startup.js",

27 "lint": "eslint src/ bin/ test/",

28 "lint:fix": "eslint src/ bin/ test/ --fix",

29 "lint:errors-only": "eslint src/ bin/ test/ --quiet",

30 "smoke": "node --check bin/natureco.js && node bin/natureco.js help",

31 "smoke:context": "node scripts/e2e-context-smoke.js",

32 "smoke:browser": "node scripts/e2e-browser-smoke.js",

33 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "prepublishOnly": "node --check bin/natureco.js && eslint src/ bin/ test/ --quiet && vitest run"

35 },

36 "keywords": [

37 "natureco",

38 "ai",

39 "ai-agent",

40 "bot",

41 "cli",

42 "terminal",

43 "openclaw-alternative",

44 "claude-code-alternative",

45 "multi-agent",

46 "self-evolving-skills",

47 "audit-log",

48 "cost-optimization",

49 "seo",

50 "türkçe",

51 "turkish",

52 "whatsapp-bot",

53 "telegram-bot",

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * NatureCo CLI - Post-install script (v5.6.0)

4 *

5 * Bu script npm install sirasinda otomatik calisir.

6 * Hatalari onceden duzeltir:

7 * - chalk v5 (ESM) yerine chalk@4 (CJS) kur

8 * - Doctor calistir

9 * - Soul dosyalarini generic yap (Personal yoksa)

10 */

11

src/commands/policy.jsView file

Lines 72-112javascript

72 id: 'git-config',

73 name: L('Git Yapılandırması', 'Git Configuration'),

74 check: () => {

75 try {

76

bin/natureco.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3// Fast path: version checks are used by shells, installers and health probes.

4// Avoid loading Commander and ~100 command modules for a constant-time answer.

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[

src/commands/gateway-server.jsView file

Lines 1-24javascript

1const chalk = require('chalk');

2const fs = require('fs');

3const path = require

src/tools/cron_create.jsView file

Lines 1-30javascript

1/**

2 * cron_create - Zamanlanmis gorev (v4.9.0)

3 *

4 * Hermes cronjob'una benzer. "Her gun 09:00'da calistir" gibi.

5 * NatureCo CLI mevcut cron sistemine yazar (cron.js zaten var).

6 */

7

8const fs = require("fs");

src/tools/voice_chat.jsView file

Lines 1-35javascript

1/**

2 * voice_chat - Sesli asistan (v5.3.0)

3 *

4 * Voice chat — sesli iletisim

5 *

6 * Mikrofon → Whisper STT → REPL'e metin olarak gönder

7 * Bot cevabı → TTS ile sesli oku

8 *

9 * macOS icin: afplay + sox/rec + Whisper

10 * Cross-platform: openai-whisper API veya local whisper.cpp

11 */

src/tools/phone_control_enhanced.jsView file

1const { getConfig, saveConfig } = require('../utils/config'); L2: const { execFileSync } = require('child_process'); L3: ... L56: if (service === 'pushover') { L57: const token = config.pushoverToken || process.env.PUSHOVER_TOKEN; L58: const user = config.pushoverUser || process.env.PUSHOVER_USER; L59: if (!token || !user) return { success: false, error: 'Pushover token/user gerekli' }; L60: const r = await fetch('https://api.pushover.net/1/messages.json', { L61: method: 'POST', L62: headers: { 'Content-Type': 'application/json' }, L63: body: JSON.stringify({ token, user, title: params.title || 'NatureCo', message: params.message, priority: params.priority || 0 }) L64: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/phone_control_enhanced.jsView on unpkg · L1

src/tools/youtube_ac.jsView file

4L5: const { spawn, execFileSync } = require("child_process"); L6: const os = require("os"); ... L30: function isUrl(str) { L31: return str.startsWith("http://") || str.startsWith("https://"); L32: } ... L64: ? spawn("open", browser ? ["-a", browser, youtubeUrl] : [youtubeUrl]) L65: : process.platform === "win32" L66: ? spawn("cmd", ["/c", "start", "", youtubeUrl], { windowsHide: true })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/update.jsView file

137try { L138: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L139: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L137

src/commands/code_v5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = natureco-cli@5.71.5 matchedIdentity = npm:bmF0dXJlY28tY2xp:5.71.5 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/code_v5.jsView on unpkg