Loading npm security reports…

pi-usereq: dependency script approval risk (Block) | LPM Firewall

registry / pi-usereq / 0.74.0

pi-usereq@0.74.0

<p align="center"> <img src="https://img.shields.io/badge/python-3.11%2B-3776AB?style=flat-square&logo=python&logoColor=white" alt="Python 3.11+"> <img src="https://img.shields.io/badge/license-GPL--3.0-491?style=flat-square" alt="License: GPL-3.0">

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The postinstall hook can broaden the consumer project’s dependency install-script approvals. It scans installed dependencies and grants name-wide approvals for those with install lifecycle scripts.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm runs this package’s postinstall hook.

Impact

Unrelated dependency install scripts may be approved across versions. The hook itself must be allowed to run; the new approvals do not necessarily execute scripts in the same install transaction.

Mechanism

The hook reads consumer node_modules and writes missing package names as true entries in the consumer package.json allowScripts map, without an explicit informed-consent check.

Policy narrative

On postinstall, the package scans the consumer project’s installed dependencies for preinstall, install, or postinstall scripts, then adds name-only true approvals to the consumer package.json allowScripts map. Those approvals can apply across dependency versions. The existing entries are preserved, but there is no explicit informed-consent check for granting new approvals. The hook must itself be allowed to run, and approved scripts are not necessarily executed in the same install transaction.

AI rationale

The postinstall automatically grants install-script approvals to unrelated consumer dependencies by package name, without explicit informed consent. This is a verified dependency approval boundary violation, so it warrants blocking.

Evidence

package.jsonscripts/install-static-checkers.tsconsumer package.json

Decision evidence

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 },

8 "bugs": {

9 "url": "https://github.com/Ogekuri/PI-useReq/issues"

10 },

11 "homepage": "https://github.com/Ogekuri/PI-useReq#readme",

12 "type": "module",

13 "files": [

14 "src",

15 "scripts"

16 ],

17 "scripts": {

18 "test": "node --import tsx --test tests/**/*.test.ts",

19 "test:watch": "node --import tsx --test --watch tests/**/*.test.ts",

20 "cli": "node --import tsx ./src/cli.ts",

21 "debug:ext": "node --import tsx ./scripts/debug-extension.ts",

22 "debug:ext:inspect": "node --import tsx ./scripts/debug-extension.ts inspect",

23 "debug:ext:session": "node --import tsx ./scripts/debug-extension.ts session-start",

24 "debug:ext:command": "node --import tsx ./scripts/debug-extension.ts command",

25 "debug:ext:tool": "node --import tsx ./scripts/debug-extension.ts tool",

26 "debug:ext:sdk": "node --import tsx ./scripts/debug-extension.ts sdk-smoke",

27 "postinstall": "node --import tsx ./scripts/install-static-checkers.ts"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "pi": {

30 "extensions": [

31 "./src/index.ts"

32 ]

33 },

34 "peerDependencies": {

35 "@earendil-works/pi-ai": "^1.0.0",

36 "@earendil-works/pi-coding-agent": "^1.0.0",

37 "@earendil-works/pi-tui": "^1.0.0",

38 "@sinclair/typebox": "^0.34.49"

39 },

40 "dependencies": {

41 "eslint": "^10.7.0",

42 "fast-glob": "^3.3.3",

43 "js-tiktoken": "^1.0.21",

44 "pyright": "^1.1.411",

45 "ruff": "^1.5.4",

46 "tsx": "^4.21.0"

47 },

scripts/lib/extension-debug-harness.tsView file

Lines 117-157typescript

117 const resolvedCwd = path.resolve(cwd ?? process.cwd());

118 if (!fs.existsSync(resolvedCwd) || !fs.statSync(resolvedCwd).

scripts/pi-cli-update-src-docs.shView file

•path = scripts/pi-cli-update-src-docs.sh kind = build_helper sizeBytes = 17509 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pi-cli-update-src-docs.shView on unpkg

src/core/pi-notify.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-usereq@0.50.0 matchedIdentity = npm:cGktdXNlcmVx:0.50.0 similarity = 0.541 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/pi-notify.tsView on unpkg