Loading npm security reports…

pierre-review@0.1.79: Suspicious npm security report (Warn) | LPM Firewall

registry / pierre-review / 0.1.79

pierre-review@0.1.79

Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 2.84 MB of source, external domains: api.github.com, cli.github.com, github.com, hooks.slack.com, linear.app, momentjs.com, naver.github.io, reactjs.org, visjs.github.io, www.w3.org, your-org.atlassian.net

Source & flagged code

2 flagged

dist/pro/bind.jsView file

Lines 28-68javascript

28export async function bindProPlugin(app) {

29 if (!config.proEnabled)

30 return; // master gate (Pro is local-only for now)

31 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

32 const here = fileURLToPath(import.meta.url);

33 const repoRoot = resolve(dirname(here), '../../../..');

34 // PRO_PLUGIN_PATH is an explicit entry-file override, tried FIRST. The cloud Docker image

35 // flattens the release layout (backend runs from /app/dist/…), so the repo-relative

36 // packages/pro paths below don't exist there — the image sets PRO_PLUGIN_PATH=/app/pro/index.js

37 // to point straight at the copied-in built plugin. It reveals nothing about Pro (just a path).

38 const entry = [

39 process.env.PRO_PLUGIN_PATH, // explicit override (cloud/Docker image)

40 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

41 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

42 ]

43 .filter((p) => Boolean(p))

44 .find(existsSync);

45 if (!entry) {

46 app.log.debug('pro plugin submodule absent — OSS mode');

47 return;

48 }

49 const mod = await import(pathToFileURL(entry).href).catch((err) => {

50 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L48

51 return null;

52 });

53 if (!mod)

54 return;

55 const plugin = (mod.default ?? mod);

56 if (plugin?.apiVersion !== 12 || typeof plugin.register !== 'function') {

57 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

58 return;

59 }

60 const ctx = {

61 log: app.log,

62 host: {

63 version: process.env.npm_package_version ?? '0.0.0',

64 deploymentMode: config.deploymentMode,

65 isCloud: config.isCloud,

66 },

67 accountIdOf,

68 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from

Source & flagged code

2 flagged · loading source

dist/pro/bind.js

Source & flagged code

2 flagged

dist/pro/bind.jsView file

Lines 28-68javascript

28export async function bindProPlugin(app) {

29 if (!config.proEnabled)

30 return; // master gate (Pro is local-only for now)

31 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

32 const here = fileURLToPath(import.meta.url);

33 const repoRoot = resolve(dirname(here), '../../../..');

34 // PRO_PLUGIN_PATH is an explicit entry-file override, tried FIRST. The cloud Docker image

35 // flattens the release layout (backend runs from /app/dist/…), so the repo-relative

36 // packages/pro paths below don't exist there — the image sets PRO_PLUGIN_PATH=/app/pro/index.js

37 // to point straight at the copied-in built plugin. It reveals nothing about Pro (just a path).

38 const entry = [

39 process.env.PRO_PLUGIN_PATH, // explicit override (cloud/Docker image)

40 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

41 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

42 ]

43 .filter((p) => Boolean(p))

44 .find(existsSync);

45 if (!entry) {

46 app.log.debug('pro plugin submodule absent — OSS mode');

47 return;

48 }

49 const mod = await import(pathToFileURL(entry).href).catch((err) => {

50 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L48

51 return null;

52 });

53 if (!mod)

54 return;

55 const plugin = (mod.default ?? mod);

56 if (plugin?.apiVersion !== 12 || typeof plugin.register !== 'function') {

57 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

58 return;

59 }

60 const ctx = {

61 log: app.log,

62 host: {

63 version: process.env.npm_package_version ?? '0.0.0',

64 deploymentMode: config.deploymentMode,

65 isCloud: config.isCloud,

66 },

67 accountIdOf,

68 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code