overtree@0.1.5: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

overtree@0.1.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

web.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = overtree@0.1.4 matchedIdentity = npm:b3ZlcnRyZWU:0.1.4 similarity = 0.966 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web.jsView on unpkg

1import { createReadStream } from "node:fs"; L2: import { spawn } from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

web.jsView on unpkg · L1

src/agent-runner.jsView file

605? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network comma... L606: : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to... L607: : "No shell command tool is available.",

High

Shell

Package source references shell execution.

src/agent-runner.jsView on unpkg · L605

src/skillmesh.jsView file

3import fsSync from "node:fs"; L4: import http from "node:http"; L5: import os from "node:os"; ... L7: import process from "node:process"; L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L61: downloadPolicy: { L62: autoDownloadMetadata: true, L63: autoDownloadPacks: false, ... L88: try { L89: return JSON.parse(await fs.readFile(filePath, "utf8")); L90: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/skillmesh.jsView on unpkg · L3

src/web-autostart.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import fs from "node:fs/promises"; L3: import http from "node:http"; L4: import net from "node:net"; ... L12: function normalizeHost(host) { L13: return String(host || process.env.AGINTI_WEB_HOST || process.env.HOST || DEFAULT_HOST).trim() || DEFAULT_HOST; L14: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/web-autostart.jsView on unpkg · L1

src/auto-update.jsView file

165return await new Promise((resolve) => { L166: const child = spawn(npmCommand(), ["install", "-g", `${packageName}@latest`, "--no-audit", "--no-fund"], { L167: stdio: "inherit", ... L174: code, L175: error: code === 0 ? "" : `npm install exited with ${signal || code}`, L176: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/auto-update.jsView on unpkg · L165

scripts/setup-agent-toolchain-docker.shView file

•path = scripts/setup-agent-toolchain-docker.sh kind = build_helper sizeBytes = 3892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-agent-toolchain-docker.shView on unpkg

paper-ui/vendor/document-editors.jsView file

•path = paper-ui/vendor/document-editors.js kind = oversized_source_file sizeBytes = 8216562 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

paper-ui/vendor/document-editors.jsView on unpkg

package.jsonView file

•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg