Loading npm security reports…

orin-ide@1.0.9: Suspicious npm security report (Warn) | LPM Firewall

registry / orin-ide / 1.0.9

orin-ide@1.0.9

AI-powered browser-based coding environment with terminal, file system, multi-model AI chat, diff viewer, HTML preview, free image API, snippet palette, and project-wide find & replace.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 166 file(s), 5.47 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.example.com, api.github.com, api.groq.com, api.iconify.design, api.openai.com, api.openverse.org, api.together.xyz, bugzilla.mozilla.org, cdn2.thecatapi.com, code.google.com, code.visualstudio.com, coverr.co, developer.mozilla.org, developers.google.com, devicon.dev, drafts.csswg.org, en.wikipedia.org, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, heroicons.com, html.spec.whatwg.org, icons.getbootstrap.com, ifconfig.me, images.dog.ceo, json-schema.org, jsonplaceholder.typicode.com, loremflickr.com, lucide.dev, mixkit.co, ollama.com, openrouter.ai, orinide.netlify.app, picsum.photos, pixabay.com, r12a.github.io, randomfox.ca, sass-lang.com, schema.org, source.unsplash.com, stackoverflow.com, support.google.com, tabler-icons.io, tools.ietf.org, undraw.co, wiki.whatwg.org

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

3L4: const { spawnSync } = require('child_process'); L5: const path = require('path');

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L3

frontend/public/vendor/monaco-editor/min/vs/base/worker/workerMain.jsView file

16`).slice(2).join(` L17: `))}}class c{constructor(v){this.value=v}}const m=2,f=(g,v)=>{if(g instanceof c)v(g);else for(let R=0;R<g.length;R++){const N=g[R];N&&v(N)}};class y{constructor(v){var R,N,D,x,T;th... L18: `)}isStronglyEqual(d,b){return this.lines[d]===this.lines[b]}}n.LineSequence=M;function A(i){let d=0;for(;d<i.length&&(i.charCodeAt(d)===32||i.charCodeAt(d)===9);)d++;return d}}),Y...

High

Shell

Package source references shell execution.

frontend/public/vendor/monaco-editor/min/vs/base/worker/workerMain.jsView on unpkg · L16

9`)),h.unresolvedDependenciesCount--;continue}if(this._inverseDependencies2[a.id]=this._inverseDependencies2[a.id]||[],this._inverseDependencies2[a.id].push(h.id),a instanceof d){le... L10: })`}});function i(){try{return(A?globalThis.eval(A.createScript("","true")):new Function("true")).call(globalThis),!0}catch{return!1}}function d(){return new Promise((L,e)=>{if(typ... L11: //# sourceURL=${a}`,(A?globalThis.eval(A.createScript("",c)):new Function(c)).call(globalThis),L()}).then(void 0,e);return}A?importScripts(A.createScriptURL(a)):importScripts(a),L(... ... L24: `?new e(_):null;S.reset(E.column-1);const v=S.next(_);return v?L(this._getMultilineMatchRange(w,s,_,g,v.index,v[0]),v,C):E.lineNumber!==1||E.column!==1?this._doFindNextMatchMultili... L25: `||e===" "}}),Y(X[58],J([0,1]),funct

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

frontend/public/vendor/monaco-editor/min/vs/base/worker/workerMain.jsView on unpkg · L9

frontend/public/vendor/monaco-editor/min/vs/loader.min.jsView file

5* https://github.[redacted].txt L6: *-----------------------------------------------------------*/const _amdLoaderGlobal=this,_commonjsGlobal=typeof global=="object"?global:{};var AMDLoader;(function(u){u.global=_amd... L7: //# sourceURL=${i}`,(l?self.eval(l.createScript("",o)):new Function(o)).call(self),s()}).then(void 0,n);return}try{l&&(i=l.createScriptURL(i)),importScripts(i),s()}catch(o){n(o)}}}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

frontend/public/vendor/monaco-editor/min/vs/loader.min.jsView on unpkg · L5

frontend/public/js/editor.jsView file

19require.config({ paths: { vs: 'vendor/monaco-editor/min/vs' } }); L20: require(['vs/editor/editor.main'], () => this._mount(), () => this._showLoadError()); L21: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

frontend/public/js/editor.jsView on unpkg · L19

bin/orin-ide.jsView file

6Detached bundled service listener: bin/orin-ide.js spawns backend/server.js; helper exposes a broad-bound HTTP listener. L6: const os = require('os'); L7: const { execSync, spawn, spawnSync } = require('child_process'); L8: L9: const pkg = require('../package.json'); L10: const serverPath = path.join(__dirname, '..', 'backend', 'server.js'); L11: const setupScript= path.join(__dirname, '..', 'setup.sh'); ... L31: const isTermux = !!( L32: process.env.PREFIX && process.env.PREFIX.includes('com.termux') L33: ); ... L69: L70: const url = `http://127.0.0.1:${port}`; L71: console.log(`\n🚀 OrinIDE is starting on ${url}`);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/orin-ide.jsView on unpkg · L6

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 8676 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

frontend/public/vendor/fonts/jetbrains-mono/jetbrains-mono-latin-400-normal.woff2View file

•path = [redacted]-mono/jetbrains-mono-latin-400-normal.woff2 kind = high_entropy_blob sizeBytes = 21168 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/public/vendor/fonts/jetbrains-mono/jetbrains-mono-latin-400-normal.woff2View on unpkg

frontend/public/vendor/monaco-editor/min/vs/language/typescript/tsWorker.jsView file

•path = frontend/public/vendor/monaco-[redacted].js kind = oversized_source_file sizeBytes = 4600446 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

frontend/public/vendor/monaco-editor/min/vs/language/typescript/tsWorker.jsView on unpkg

frontend/public/js/agents.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orin-ide@1.0.8 matchedIdentity = npm:b3Jpbi1pZGU:1.0.8 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

frontend/public/js/agents.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 19-59json

19 "coding",

20 "editor",

21 "openrouter",

22 "terminal",

23 "web-ide",

24 "deepseek",

25 "monaco",

26 "code-editor",

27 "html-preview",

28 "image-api",

29 "portfolio-generator",

30 "diff-viewer"

31 ],

32 "main": "backend/server.js",

33 "bin": {

34 "orin-ide": "./bin/orin-ide.js"

35 },

36 "scripts": {

37 "start": "node backend/server.js",

38 "setup": "bash setup.sh",

39 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 },

41 "dependencies": {

42 "archiver": "^8.0.0",

43 "body-parser": "^2.2.2",

44 "chokidar": "^5.0.0",

45 "cors": "^2.8.6",

46 "express": "^5.2.1",

47 "mime-types": "^3.0.2",

48 "multer": "^2.1.1",

49 "unzipper": "^0.12.3",

50 "ws": "^8.21.0"

51 },

52 "engines": {

53 "node": ">=18.0.0"

54 },

55 "files": [

56 "bin/",

57 "backend/",

58 "frontend/",

59 "README.md",

bin/postinstall.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

3

4const { spawnSync } = require('child_process');

5const path = require('path');

frontend/public/vendor/monaco-editor/min/vs/base/worker/workerMain.jsView file

Lines 1-27javascript

1/*!-----------------------------------------------------------

2 * Copyright (c) Microsoft Corporation. All rights reserved.

3 * Version: 0.46.0(21007360cad28648bdf46282a2592cb47c3a7a6f)

4 * Released under the MIT license

5 * https://github.com/microsoft/vscode/blob/main/LICENSE.txt

6 *-----------------------------------------------------------*/(function(){var X=["require",

frontend/public/vendor/monaco-editor/min/vs/loader.min.jsView file

Lines 1-11javascript

1"use strict";/*!-----------------------------------------------------------

2 * Copyright (c) Microsoft Corporation. All rights reserved.

3 * Version: 0.46.0(21007360cad28648bdf46282a2592cb47c3a7a6f)

4 * Released under the MIT license

5 * https://github.com/microsoft/vscode/blob/main/LICENSE.txt

6 *-----------------------------------------------------------*/const _amdLoaderGlobal=this,_commonjsGlobal=typeof

frontend/public/js/editor.jsView file

Lines 1-39javascript

1'use strict';

2const EditorMgr = {

3 instance: null,

4 tabs: [],

5 active: null,

6 saveTimer: null,

7

8

bin/orin-ide.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict';

3

4const path = require('path');

5const fs = require('fs');

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 8676 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

frontend/public/vendor/fonts/jetbrains-mono/jetbrains-mono-latin-400-normal.woff2View file

•path = [redacted]-mono/jetbrains-mono-latin-400-normal.woff2 kind = high_entropy_blob sizeBytes = 21168 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend/public/vendor/fonts/jetbrains-mono/jetbrains-mono-latin-400-normal.woff2View on unpkg

frontend/public/vendor/monaco-editor/min/vs/language/typescript/tsWorker.jsView file

•path = frontend/public/vendor/monaco-[redacted].js kind = oversized_source_file sizeBytes = 4600446 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

frontend/public/vendor/monaco-editor/min/vs/language/typescript/tsWorker.jsView on unpkg

frontend/public/js/agents.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orin-ide@1.0.8 matchedIdentity = npm:b3Jpbi1pZGU:1.0.8 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

frontend/public/js/agents.jsView on unpkg