registry / npcts / 0.1.24

npcts@0.1.24

NPC TypeScript SDK - A comprehensive UI component library for building AI-powered applications

AI Security Review

scanned 8h ago · by lpm-firewall-ai

An explicitly started spatial HTTP server exposes unauthenticated shell execution and process termination. No install-time or import-time attack surface was found.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls createSpatialServer and a requester reaches its API.

Impact

Remote callers may execute commands with the server user's environment and permissions, persist processes, or terminate processes.

Mechanism

Unauthenticated HTTP-to-shell command execution.

Rationale

Source inspection found a serious unauthenticated RCE capability in an opt-in server module, not malicious install-time behavior or covert exfiltration. Flag as a critical vulnerability/dangerous capability rather than malware.

Evidence

package.jsondist/server/spatial/routes.jsdist/server/spatial/commandExecutor.jsdist/adapters/http/spatialServices.jsdist/core/jinx.jsdist/server/spatial/configStore.js

Network endpoints3

localhost:3001/api/execute/api/kill

Decision evidence

public snapshot

npcts@0.1.24

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code