porcelain-daemon@0.28.1: Suspicious npm security report (Warn)

Loading npm security reports…

porcelain-daemon@0.28.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

main/daemon/server.jsView file

Lines 1-27javascript

1"use strict";

2const node_crypto = require("node:crypto");

3const promises = require("node:fs/promises");

4const node_os = require("node:os");

5const node_path = require("node:path");

6const tokenFile = require("../chunks/token-file-CaxCxnec.js");

7const zod = require("zod");

8const node_child_process = require("node:child_process");

9const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L7

10const node_readline = require("node:readline");

11const node_util = require("node:util");

12const server$1 = require("@trpc/server");

13const trash = require("trash");

14const node_http = require("node:http");

15const nodePty = require("node-pty");

16const fetch$1 = require("@trpc/server/adapters/fetch");

17const ws = require("ws");

18require("@iarna/toml");

19const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

20const trash__default = /* @__PURE__ */ _interopDefault(trash);

21function mcpServerDir() {

22 return node_path.join(node_os.homedir(), ".porcelain", "mcp");

23}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L7

24function installedServerPath() {

25 return node_path.join(mcpServerDir(), "server.js");

26}

27function agentConfigPath(agent) {

Lines 4689-4729javascript

4689 try {

4690 const server2 = await pending;

4691 const config = await getConfigProviders(server2.baseUrl);

4692 if (config !==

•matchType = previous_version_dangerous_delta matchedPackage = porcelain-daemon@0.28.0 matchedIdentity = npm:cG9yY2VsYWluLWRhZW1vbg:0.28.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

main/daemon/server.jsView on unpkg

main/chunks/index-BlxZmzlT.jsView file

Lines 2597-2637javascript

2597 external = {

2598 Promise: ES6Promise

2599 };

2600 return external;

2601}

2602var setImmediate$1 = {};

2603var hasRequiredSetImmediate;

2604function

bin/porcelain-daemon.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Headless CLI for the published porcelain-daemon package.

3// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from

4// the monorepo root (paths resolve relative to the installed package layout).

5//

6// Goal: t3-style one-liner on a remote box —

7// npx porcelain-daemon@latest serve --tailnet

8// instead of scp'ing a dist tarball and wiring systemd.

10const { randomBytes

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-dTvRqAI6.jsView file

•path = renderer/assets/index-dTvRqAI6.js kind = oversized_source_file sizeBytes = 5789035 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-dTvRqAI6.jsView on unpkg

Source & flagged code

8 flagged · loading source

main/daemon/server.jsView file

7const zod = require("zod"); L8: const node_child_process = require("node:child_process"); L9: const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L7

4709try { L4710: const res = await fetch(`${baseUrl}/config/providers`); L4711: if (!res.ok) return null; ... L4718: return new Promise((resolve) => { L4719: node_child_process.execFile(bin, ["models"], { env }, (error, stdout) => { L4720: resolve(error ? [] : parseModelsCli(stdout)); ... L4724: function buildDrivers() { L4725: if (process.env.PORCELAIN_AGENT_FAKE === "1") { L4726: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main/daemon/server.jsView on unpkg · L4709

7const zod = require("zod"); L8: const node_child_process = require("node:child_process"); L9: const node_fs = require("node:fs"); ... L13: const trash = require("trash"); L14: const node_http = require("node:http"); L15: const nodePty = require("node-pty"); ... L21: function mcpServerDir() { L22: return node_path.join(node_os.homedir(), ".porcelain", "mcp"); L23: } ... L84: mediaType: zod.z.string(), L85: base64: zod.z.string() L86: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L7

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

main/daemon/server.jsView on unpkg

main/chunks/index-BlxZmzlT.jsView file

2617if (typeof callback !== "function") { L2618: callback = new Function("" + callback); L2619: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

main/chunks/index-BlxZmzlT.jsView on unpkg · L2617

bin/porcelain-daemon.jsView file

9L10: const { randomBytes } = require('node:crypto') L11: const { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } = require('node:fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/porcelain-daemon.jsView on unpkg · L9

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-dTvRqAI6.jsView file

•path = renderer/assets/index-dTvRqAI6.js kind = oversized_source_file sizeBytes = 5789035 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-dTvRqAI6.jsView on unpkg

Source & flagged code

8 flagged

main/daemon/server.jsView file

Lines 1-27javascript

1"use strict";

2const node_crypto = require("node:crypto");

3const promises = require("node:fs/promises");

4const node_os = require("node:os");

5const node_path = require("node:path");

6const tokenFile = require("../chunks/token-file-CaxCxnec.js");

7const zod = require("zod");

8const node_child_process = require("node:child_process");

9const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/daemon/server.jsView on unpkg · L7

10const node_readline = require("node:readline");

11const node_util = require("node:util");

12const server$1 = require("@trpc/server");

13const trash = require("trash");

14const node_http = require("node:http");

15const nodePty = require("node-pty");

16const fetch$1 = require("@trpc/server/adapters/fetch");

17const ws = require("ws");

18require("@iarna/toml");

19const _interopDefault = (e) => e && e.__esModule ? e : { default: e };

20const trash__default = /* @__PURE__ */ _interopDefault(trash);

21function mcpServerDir() {

22 return node_path.join(node_os.homedir(), ".porcelain", "mcp");

23}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L7

24function installedServerPath() {

25 return node_path.join(mcpServerDir(), "server.js");

26}

27function agentConfigPath(agent) {

Lines 4689-4729javascript

4689 try {

4690 const server2 = await pending;

4691 const config = await getConfigProviders(server2.baseUrl);

4692 if (config !==

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

main/daemon/server.jsView on unpkg

main/chunks/index-BlxZmzlT.jsView file

Lines 2597-2637javascript

2597 external = {

2598 Promise: ES6Promise

2599 };

2600 return external;

2601}

2602var setImmediate$1 = {};

2603var hasRequiredSetImmediate;

2604function

bin/porcelain-daemon.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Headless CLI for the published porcelain-daemon package.

3// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from

4// the monorepo root (paths resolve relative to the installed package layout).

5//

6// Goal: t3-style one-liner on a remote box —

7// npx porcelain-daemon@latest serve --tailnet

8// instead of scp'ing a dist tarball and wiring systemd.

10const { randomBytes

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-dTvRqAI6.jsView file

•path = renderer/assets/index-dTvRqAI6.js kind = oversized_source_file sizeBytes = 5789035 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-dTvRqAI6.jsView on unpkg

porcelain-daemon@0.28.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code