Loading npm security reports…

peaks-loop@4.0.27: Malicious npm security report (Block) | LPM Firewall

registry / peaks-loop / 4.0.27

peaks-loop@4.0.27

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically changes global AI-agent skill, agent, and output-style locations. It also changes Claude's global settings when no output style is configured.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

The package can influence behavior of installed AI coding tools without a separate user setup command.

Mechanism

Automatic cross-platform AI-agent configuration and prompt deployment.

Attack narrative

On installation, package.json invokes scripts/install-skills.mjs. That script creates or links bundled skills across several home-directory AI-tool locations, copies bundled agent prompts into global agent directories, and writes a default outputStyle into Claude settings when one is missing. These actions occur automatically rather than through an explicit configuration command, giving the package a broad persistent AI-agent control surface.

AI rationale

This is an automatic postinstall mutation of foreign and broad AI-agent control surfaces, including global skills, agents, and Claude settings. The behavior meets the install-hook abuse blocking policy even though no network exfiltration was confirmed.

Evidence

package.jsonscripts/install-skills.mjs~/.claude/skills~/.trae/skills~/.codex/skills~/.cursor/skills~/.claude/agents~/.claude/output-styles~/.claude/settings.json~/.peaks/config.json

Source & flagged code

22 flagged

package.jsonView file

Lines 111-151json

111 "@jridgewell/trace-mapping": "^0.3.31",

112 "@stryker-mutator/core": "^8.7.1",

113 "@stryker-mutator/typescript-checker": "^8.7.1",

114 "@stryker-mutator/vitest-runner": "^9.6.1",

115 "@types/better-sqlite3": "^7.6.13",

116 "@types/node": "^22.10.2",

117 "@typescript-eslint/eslint-plugin": "8.66.0",

118 "@typescript-eslint/parser": "8.66.0",

119 "@vitest/coverage-istanbul": "^4.1.10",

120 "@vitest/coverage-v8": "^4.1.10",

121 "c8": "^10.1.3",

122 "eslint": "8.57.1",

123 "tsx": "^4.19.2",

124 "typescript": "^5.7.2",

125 "vite": "^6.0.0",

126 "vitest": "^4.1.10"

127 },

128 "scripts": {

129 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && pnpm -r --filter \"./packages/*\" run build && tsc -p tsconfig.build.json && node ./scripts/copy-templates.mjs && node ./scripts/check-build-integrity.mjs",

130 "prepublish": "node ./scripts/sync-version.mjs",

131 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L131

132 "predev": "node ./scripts/sync-version.mjs",

133 "dev": "tsx src/cli/index.ts",

134 "dev:watch": "node ./scripts/watch.mjs",

135 "pretest": "node ./scripts/sync-version.mjs && pnpm --filter peaks-loop-shared build && node ./scripts/check-build-integrity.mjs",

136 "test": "vitest run",

137 "test:full": "pnpm -r --include-workspace-root --workspace-concurrency=2 run test",

138 "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",

139 "test:dev": "vitest run tests/unit",

140 "test:dev:cli": "vitest run tests/unit",

141 "test:unit": "vitest run tests/unit",

142 "test:integration": "vitest run tests/integration",

143 "test:capability-guard": "vitest run --config vitest.config.integration.ts tests/integration/capability-guard",

144 "test:cli": "vitest run tests/unit",

145 "test:workflow": "vitest run tests/unit",

146 "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

147 "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",

148 "test:changed": "node scripts/test-changed.mjs",

149 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

150 "test:race": "vitest run --no-file-parallelism packages/peaks-loop-shared-channel/tests/shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",

151 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

dist/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

dist/cli/commands/governance-classify-contract-commands.jsView file

Lines 131-171javascript

131 signatureCount: result.contract.publicSignatures.length,

132 broadcastTo: result.contract.broadcastTo ?? []

133 }, [], [

134 `Contract written; orchestrator will pick it up on the next \`peaks sub-agent dispatch --from-dag\` run.`,

135

dist/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code:

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID }

dist/cli/commands/hooks-commands.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: '.claude', 'skills', 'peaks-code', 'hooks', 'pre-tool-superpowers-bridge.sh'); if (!existssync(source)) { return { copied: false, source, target }; } mkdirsync(dirname(target), { recursive: true }); copyfilesync(source, target); return { copied: true, source, target }; }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. iedit', sentinel: 'peaks code-gate' } ]; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

dist/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949

dist/cli/commands/container-commands.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/commands/container-commands.js#virtual:normalized:round1View on unpkg

dist/cli/commands/e2e-verify.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/e2e-verify.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/e2e-verify.jsView on unpkg

dist/cli/commands/vm-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/vm-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/vm-commands.jsView on unpkg

dist/cli/commands/container-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/container-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/container-commands.jsView on unpkg

dist/cli/commands/cron-scheduler-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/cron-scheduler-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/cron-scheduler-commands.jsView on unpkg

dist/cli/commands/worktree-auth-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/worktree-auth-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/worktree-auth-commands.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/dispatch/dispatch-record-writer.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/services/dispatch/dispatch-record-writer.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/dispatch/dispatch-record-writer.jsView on unpkg

dist/services/lint/eslint-runner.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/services/lint/eslint-runner.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/lint/eslint-runner.jsView on unpkg

dist/cli/commands/lease-metrics-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/lease-metrics-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/lease-metrics-commands.jsView on unpkg

dist/cli/commands/test-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/test-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/test-commands.jsView on unpkg

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/services/upgrade/upgrade-service.jsView file

182// npm install postinstall creates `peaks` → `peaks.sh` on L183: // Windows). cmd.exe (the default Windows shell) cannot run L184: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/services/upgrade/upgrade-service.jsView on unpkg · L182

dist/cli/commands/governance-classify-contract-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/governance-classify-contract-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/governance-classify-contract-commands.jsView on unpkg

151try { L152: const { execFileSync } = require('node:child_process'); L153: stdout = execFileSync('git', ['diff', '--shortstat', 'HEAD'], {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/governance-classify-contract-commands.jsView on unpkg · L151

dist/services/code/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/services/code/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1#!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L285: fchmodSync(fd, 0o600); L286: writeFileSync(fd, content, 'utf8'); L287: const writeFd = fd; ... L314: fchmodSync(fd, 0o600); L315: writeFileSync(fd, content, 'utf8'); L316: const writeFd = fd; ... L366: * cannot import the TS service at runtime. The dispatch: L367: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L368: * `.tongyi-lingma` in the project root in that insertion order

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L1

dist/cli/commands/hooks-commands.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. iedit', sentinel: 'peaks code-gate' } ]; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

dist/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/playwright-commands.jsView on unpkg · L27

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.21 matchedPath = dist/cli/commands/playwright-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/playwright-commands.jsView on unpkg

dist/cli/commands/container-commands.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/commands/container-commands.js#virtual:normalized:round1View on unpkg

dist/cli/commands/e2e-verify.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/e2e-verify.jsView on unpkg

dist/cli/commands/vm-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/vm-commands.jsView on unpkg

dist/cli/commands/container-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/container-commands.jsView on unpkg

dist/cli/commands/cron-scheduler-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/cron-scheduler-commands.jsView on unpkg

dist/cli/commands/worktree-auth-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/worktree-auth-commands.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/dispatch/dispatch-record-writer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/dispatch/dispatch-record-writer.jsView on unpkg

dist/services/lint/eslint-runner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/lint/eslint-runner.jsView on unpkg

dist/cli/commands/lease-metrics-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/lease-metrics-commands.jsView on unpkg

dist/cli/commands/test-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/test-commands.jsView on unpkg

Source & flagged code

22 flagged

package.jsonView file

Lines 111-151json

111 "@jridgewell/trace-mapping": "^0.3.31",

112 "@stryker-mutator/core": "^8.7.1",

113 "@stryker-mutator/typescript-checker": "^8.7.1",

114 "@stryker-mutator/vitest-runner": "^9.6.1",

115 "@types/better-sqlite3": "^7.6.13",

116 "@types/node": "^22.10.2",

117 "@typescript-eslint/eslint-plugin": "8.66.0",

118 "@typescript-eslint/parser": "8.66.0",

119 "@vitest/coverage-istanbul": "^4.1.10",

120 "@vitest/coverage-v8": "^4.1.10",

121 "c8": "^10.1.3",

122 "eslint": "8.57.1",

123 "tsx": "^4.19.2",

124 "typescript": "^5.7.2",

125 "vite": "^6.0.0",

126 "vitest": "^4.1.10"

127 },

128 "scripts": {

130 "prepublish": "node ./scripts/sync-version.mjs",

131 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L131

132 "predev": "node ./scripts/sync-version.mjs",

133 "dev": "tsx src/cli/index.ts",

134 "dev:watch": "node ./scripts/watch.mjs",

135 "pretest": "node ./scripts/sync-version.mjs && pnpm --filter peaks-loop-shared build && node ./scripts/check-build-integrity.mjs",

136 "test": "vitest run",

137 "test:full": "pnpm -r --include-workspace-root --workspace-concurrency=2 run test",

138 "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",

139 "test:dev": "vitest run tests/unit",

140 "test:dev:cli": "vitest run tests/unit",

141 "test:unit": "vitest run tests/unit",

142 "test:integration": "vitest run tests/integration",

143 "test:capability-guard": "vitest run --config vitest.config.integration.ts tests/integration/capability-guard",

144 "test:cli": "vitest run tests/unit",

145 "test:workflow": "vitest run tests/unit",

146 "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

147 "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",

148 "test:changed": "node scripts/test-changed.mjs",

149 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

151 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

dist/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

dist/cli/commands/governance-classify-contract-commands.jsView file

Lines 131-171javascript

131 signatureCount: result.contract.publicSignatures.length,

132 broadcastTo: result.contract.broadcastTo ?? []

133 }, [], [

134 `Contract written; orchestrator will pick it up on the next \`peaks sub-agent dispatch --from-dag\` run.`,

135

dist/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code:

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID }

dist/cli/commands/hooks-commands.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. iedit', sentinel: 'peaks code-gate' } ]; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

dist/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949

dist/cli/commands/container-commands.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/commands/container-commands.js#virtual:normalized:round1View on unpkg

dist/cli/commands/e2e-verify.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/e2e-verify.jsView on unpkg

dist/cli/commands/vm-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/vm-commands.jsView on unpkg

dist/cli/commands/container-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/container-commands.jsView on unpkg

dist/cli/commands/cron-scheduler-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/cron-scheduler-commands.jsView on unpkg

dist/cli/commands/worktree-auth-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/worktree-auth-commands.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/dispatch/dispatch-record-writer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/dispatch/dispatch-record-writer.jsView on unpkg

dist/services/lint/eslint-runner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/lint/eslint-runner.jsView on unpkg

dist/cli/commands/lease-metrics-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/lease-metrics-commands.jsView on unpkg

dist/cli/commands/test-commands.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/test-commands.jsView on unpkg

peaks-loop@4.0.27

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code