neuro-cli@5.0.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

neuro-cli@5.0.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "console.log('\n Thanks for installing NeuroCLI! Run \'neuro\' to get started.\n')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "console.log('\n Thanks for installing NeuroCLI! Run \'neuro\' to get started.\n')"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/context/custom-tools.jsView file

296// eslint-disable-next-line no-new-func L297: const fn = new Function(`return (${objStr});`); L298: const result = fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/context/custom-tools.jsView on unpkg · L296

dist/context/git-checkpoint.jsView file

204mkdirSync(join(dst, '..'), { recursive: true }); L205: const { copyFileSync } = require('fs'); L206: copyFileSync(src, dst);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/context/git-checkpoint.jsView on unpkg · L204

dist/tools/browser.jsView file

5// ============================================================ L6: import { spawn, execSync } from 'child_process'; L7: import { existsSync, mkdirSync, writeFileSync } from 'fs'; ... L90: const wsModule = await import('ws'); L91: const WebSocket = wsModule.default || wsModule.WebSocket || wsModule; L92: return new Promise((resolve, reject) => { ... L145: }); L146: this.ws.send(JSON.stringify(message)); L147: }); ... L177: try { L178: const message = JSON.parse(data); L179: // Response to a request

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tools/browser.jsView on unpkg · L5

dist/core/shell-completion.jsView file

43'# neuro completion bash > ~/.neuro/completion/neuro.bash', L44: '# echo "source ~/.neuro/completion/neuro.bash" >> ~/.bashrc', L45: '# ------------------------------------------------------------------',

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/shell-completion.jsView on unpkg · L43

Source & flagged code

6 flagged

package.jsonView file

Lines 3-43json

3 "version": "5.0.1",

4 "description": "Advanced AI-powered terminal coding assistant with multi-agent orchestration, sub-agent spawning, ACP protocol, OS-level sandboxing, spec-driven development, smart monitoring, multi-model routing, MCP Apps, auto-updater, and 23+ free models",

5 "main": "dist/index.js",

6 "bin": {

7 "neuro": "dist/index.js"

8 },

9 "type": "module",

10 "files": [

11 "dist/**/*.js",

12 "dist/**/*.d.ts",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "build": "tsc",

18 "dev": "tsx src/index.ts",

19 "start": "node dist/index.js",

20 "lint": "eslint src/",

21 "clean": "rm -rf dist/",

22 "prepublishOnly": "npm run build",

23 "postinstall": "node -e \"console.log('\\n Thanks for installing NeuroCLI! Run \\'neuro\\' to get started.\\n')\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "keywords": [

26 "ai",

27 "cli",

28 "coding",

29 "assistant",

30 "openrouter",

31 "agent",

32 "multi-agent",

33 "llm",

34 "terminal",

35 "chatgpt",

36 "copilot",

37 "code-assistant",

38 "mcp",

39 "spec-driven",

40 "sandbox"

41 ],

42 "author": "Muhammed Turan <muhammedturan65>",

43 "license": "MIT",

dist/context/custom-tools.jsView file

Lines 276-316javascript

276 /**

277 * Attempt to extract a tool definition object from source code text.

278 * Looks for common export patterns and parses the object literal.

279 */

280 extractDefinitionFromSource(source, filePath) {

281 // Try to find: export const toolDefinition = { ... }

282 // or: export default { ... }

283 const

dist/context/git-checkpoint.jsView file

Lines 184-224javascript

184 if (!existsSync(gitDir)) {

185 try {

186 execSync('git init', { cwd: this.shadowRepo, encoding: 'utf-8' });

187 }

188 catch { }

dist/tools/browser.jsView file

Lines 1-25javascript

1// ============================================================

2// NeuroCLI - Browser Automation Tool

3// Headless Chrome control via Chrome DevTools Protocol

4// Fallback: curl-based HTTP requests when no browser available

5// ============================================================

6import { spawn, execSync } from 'child_process';

7import { existsSync, mkdirSync, writeFileSync } from 'fs';

dist/core/shell-completion.jsView file

Lines 23-63javascript

23 return this.generateBash();

24 case 'zsh':

25 return this.generateZsh();

26 case 'fish':