overtree@0.1.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

overtree@0.1.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

web.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = overtree@0.1.2 matchedIdentity = npm:b3ZlcnRyZWU:0.1.2 similarity = 0.948 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web.jsView on unpkg

1import { createReadStream } from "node:fs"; L2: import { spawn } from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

web.jsView on unpkg · L1

src/agent-runner.jsView file

605? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network comma... L606: : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to... L607: : "No shell command tool is available.",

High

Shell

Package source references shell execution.

src/agent-runner.jsView on unpkg · L605

src/skillmesh.jsView file

3import fsSync from "node:fs"; L4: import http from "node:http"; L5: import os from "node:os"; ... L7: import process from "node:process"; L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L61: downloadPolicy: { L62: autoDownloadMetadata: true, L63: autoDownloadPacks: false, ... L88: try { L89: return JSON.parse(await fs.readFile(filePath, "utf8")); L90: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/skillmesh.jsView on unpkg · L3

src/web-autostart.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; L3: import http from "node:http"; L4: import net from "node:net"; ... L12: function normalizeHost(host) { L13: return String(host || process.env.AGINTI_WEB_HOST || process.env.HOST || DEFAULT_HOST).trim() || DEFAULT_HOST; L14: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/web-autostart.jsView on unpkg · L1

src/auto-update.jsView file

165return await new Promise((resolve) => { L166: const child = spawn(npmCommand(), ["install", "-g", `${packageName}@latest`, "--no-audit", "--no-fund"], { L167: stdio: "inherit", ... L174: code, L175: error: code === 0 ? "" : `npm install exited with ${signal || code}`, L176: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/auto-update.jsView on unpkg · L165

scripts/setup-agent-toolchain-docker.shView file

•path = scripts/setup-agent-toolchain-docker.sh kind = build_helper sizeBytes = 3892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-agent-toolchain-docker.shView on unpkg

paper-ui/vendor/document-editors.jsView file

•path = paper-ui/vendor/document-editors.js kind = oversized_source_file sizeBytes = 8216044 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

paper-ui/vendor/document-editors.jsView on unpkg

package.jsonView file

•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Source & flagged code

9 flagged

web.jsView file

Lines 1-21javascript

1import { createReadStream } from "node:fs";

2import { spawn } from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

web.jsView on unpkg · L1

4import express from "express";

5import os from "node:os";

6import path from "node:path";

7import { fileURLToPath } from "node:url";

8import WordExtractor from "word-extractor";

9import { runAgent } from "./src/agent-runner.js";

10import { resolveRuntimeConfig } from "./src/config.js";

11import { WebDatabase } from "./src/web-db.js";

12import { SessionStore } from "./src/session-store.js";

13import {

14 AUXILIARY_MODEL_CATALOG,

15 MODEL_PROVIDER_GROUPS,

16 PROVIDER_MODEL_CATALOG,

17 getModelPresets,

18 getModelRoleDefaults,

19 getProviderDefaults,

20 normalizeRoutingMode,

21} from "./src/model-routing.js";

•matchType = previous_version_dangerous_delta matchedPackage = overtree@0.1.2 matchedIdentity = npm:b3ZlcnRyZWU:0.1.2 similarity = 0.948 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web.jsView on unpkg

src/agent-runner.jsView file

Lines 585-625javascript

585 {

586 role: "system",

587 content: [

588 "You are a careful browser and shell agent with a small tool surface.",

589 "Use only the provided tools.",

590 "The execution plan is not the final answer. After planning, actively use tools until the requested task is complete or genuinely blocked.",

src/skillmesh.jsView file

Lines 1-23javascript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import fsSync from "node:fs";

4import http from "node:http";

src/web-autostart.jsView file

Lines 1-21javascript

1import { execFile, spawn } from "node:child_process";

2import fs from "node:fs/promises";

3import http from "node:http";

4import net from "node:net";

src/auto-update.jsView file

Lines 145-185javascript

145 if (raw === undefined || raw === "") return DEFAULT_CHECK_INTERVAL_MS;

146 const value = Number(raw);

147

scripts/setup-agent-toolchain-docker.shView file

•path = scripts/setup-agent-toolchain-docker.sh kind = build_helper sizeBytes = 3892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-agent-toolchain-docker.shView on unpkg

paper-ui/vendor/document-editors.jsView file

•path = paper-ui/vendor/document-editors.js kind = oversized_source_file sizeBytes = 8216044 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

paper-ui/vendor/document-editors.jsView on unpkg

package.jsonView file

Lines 32-72json

32 "LICENSE",

33 "README.md",

34 "bin/",

35 "docs/overtree-user-guide.zh.md",

36 "docker/",

37 "logos/logo.png",

38 "paper-ui/"