pi-harness-runtime: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

pi-harness-runtime: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harness/e2e/playwright-runner.tsView file

169// eslint-disable-next-line no-eval L170: return eval(String(cond)) as boolean; // eslint-disable-line L171: }, condition);

Low

Eval

Package source references a known benign dynamic code generation pattern.

harness/e2e/playwright-runner.tsView on unpkg · L169

packages/write-review/src/trigger.tsView file

67function scanDir(dir: string): void { L68: const { readdirSync, statSync } = require("fs"); L69: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/write-review/src/trigger.tsView on unpkg · L67

packages/scheduler-adapter/dist/cron.jsView file

3* L4: * Writes crontab entries for scheduled tasks. L5: * Entries are managed via a marker block so unschedule() is clean. L6: */ L7: import { execSync } from "node:child_process"; L8: import { writeFileSync, unlinkSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/scheduler-adapter/dist/cron.jsView on unpkg · L3

scripts/scan-secrets.shView file

•path = scripts/scan-secrets.sh kind = build_helper sizeBytes = 1945 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/scan-secrets.shView on unpkg

.pi/plugins/herdr-clipboard/tmux-watch.shView file

•path = .pi/plugins/herdr-clipboard/tmux-watch.sh kind = payload_in_excluded_dir sizeBytes = 1169 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/plugins/herdr-clipboard/tmux-watch.shView on unpkg

packages/auth/dist/minimax-browser-auth.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.7 matchedPath = packages/auth/dist/minimax-browser-auth.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/auth/dist/minimax-browser-auth.jsView on unpkg

packages/auth/src/minimax-browser-auth.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.7 matchedPath = packages/auth/src/minimax-browser-auth.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/auth/src/minimax-browser-auth.tsView on unpkg

scripts/release-all.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.7 matchedPath = scripts/release-all.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-all.tsView on unpkg

packages/runtime/command-executor.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.7 matchedPath = packages/runtime/command-executor.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/runtime/command-executor.tsView on unpkg

packages/runtime/dist/command-executor.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.7 matchedPath = packages/runtime/dist/command-executor.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/runtime/dist/command-executor.jsView on unpkg