plan-assistant: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

plan-assistant: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/cli/server-client.jsView file

7import { fileURLToPath } from "node:url"; L8: import { spawn, execSync } from "node:child_process"; L9: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/cli/server-client.jsView on unpkg · L7

7Cross-file remote execution chain: dist/cli/server-client.js spawns build/server/index.js; helper contains network access plus dynamic code execution. L7: import { fileURLToPath } from "node:url"; L8: import { spawn, execSync } from "node:child_process"; L9: import { createServer } from "node:net"; L10: export const DEFAULT_BASE_PORT = 5181; ... L36: return null; L37: return (await res.json()); L38: } ... L136: env: { L137: ...process.env, L138: SESSION_DIR: sessionDir, ... L175: export async function launchServer(sessionDir, port) { L176: process.stderr.write(`Starting Plan Assistant server on port ${port}...`);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/server-client.jsView on unpkg · L7

build/client/_app/immutable/chunks/1UysTTxk.jsView file

5`},p]}}return ur=r,ur}var pr,Dl;function yp(){if(Dl)return pr;Dl=1;function t(e){const n="[a-zA-Z_][\\w.]*",a="<\\?(lasso(script)?|=)",r="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L6: ]`,g={scope:"string",variants:[d,c,u,E]},T={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L7: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return hi=t,hi}var Ii,Vc;function Hm(){if(Vc)return Ii;Vc=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",a={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

build/client/_app/immutable/chunks/1UysTTxk.jsView on unpkg · L5

dist/cli/export-html.jsView file

44try { L45: const require = createRequire(import.meta.url); L46: hljs = require("highlight.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/export-html.jsView on unpkg · L44

Source & flagged code

4 flagged

dist/cli/server-client.jsView file

Lines 1-27javascript

1/**

2 * Server lifecycle management: port finding, health checking,

3 * lock files, and process spawning for the Plan Assistant dev server.

4 */

5import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, } from "node:fs";

6import { resolve, dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

8import { spawn, execSync } from "node:child_process";

9import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/cli/server-client.jsView on unpkg · L7

10export const DEFAULT_BASE_PORT = 5181;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/server-client.jsView on unpkg · L7

11export const MAX_PORT = 5199;

12const HEALTH_CHECK_TIMEOUT_MS = 500;

13const STARTUP_HEALTH_CHECK_TIMEOUT_MS = 1000;

14const STARTUP_POLL_INTERVAL_MS = 500;

15const STARTUP_MAX_ATTEMPTS = 30; // 30 × 500ms = 15s

16export const SHUTDOWN_TIMEOUT_MS = 2000;

17export async function fetchWithTimeout(url, options, timeoutMs) {

18 const controller = new AbortController();

19 const timeout = setTimeout(() => controller.abort(), timeoutMs);

20 try {

21 return await fetch(url, { ...options, signal: controller.signal });

22 }

23 finally {

24 clearTimeout(timeout);

25 }

26}

27function getPackageDir() {

build/client/_app/immutable/chunks/1UysTTxk.jsView file

5`},p]}}return ur=r,ur}var pr,Dl;function yp(){if(Dl)return pr;Dl=1;function t(e){const n="[a-zA-Z_][\\w.]*",a="<\\?(lasso(script)?|=)",r="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L6: ]`,g={scope:"string",variants:[d,c,u,E]},T={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L7: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return hi=t,hi}var Ii,Vc;function Hm(){if(Vc)return Ii;Vc=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",a={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

build/client/_app/immutable/chunks/1UysTTxk.jsView on unpkg · L5

dist/cli/export-html.jsView file

Lines 24-64javascript

24 : comments.filter((c) => !c.phaseId);

25 if (filtered.length === 0)

26 return "";

27 const