porcelain-daemon@0.30.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

porcelain-daemon@0.30.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

main/cli/porcelain.jsView file

1"use strict"; L2: const node_child_process = require("node:child_process"); L3: const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/cli/porcelain.jsView on unpkg · L1

main/chunks/index-BlxZmzlT.jsView file

2617if (typeof callback !== "function") { L2618: callback = new Function("" + callback); L2619: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

main/chunks/index-BlxZmzlT.jsView on unpkg · L2617

bin/porcelain-daemon.jsView file

9L10: const { randomBytes } = require('node:crypto') L11: const { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } = require('node:fs')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/porcelain-daemon.jsView on unpkg · L9

main/daemon/server.jsView file

4692try { L4693: const res = await fetch(`${baseUrl}/config/providers`); L4694: if (!res.ok) return null; ... L4701: return new Promise((resolve) => { L4702: node_child_process.execFile(bin, ["models"], { env }, (error, stdout) => { L4703: resolve(error ? [] : parseModelsCli(stdout)); ... L4707: function buildDrivers() { L4708: if (process.env.PORCELAIN_AGENT_FAKE === "1") { L4709: return {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main/daemon/server.jsView on unpkg · L4692

3const zod = require("zod"); L4: const node_child_process = require("node:child_process"); L5: const node_fs = require("node:fs"); ... L12: const trash = require("trash"); L13: const node_http = require("node:http"); L14: const nodePty = require("node-pty"); ... L26: mediaType: zod.z.string(), L27: base64: zod.z.string() L28: }); ... L291: function loginShell() { L292: const shell = process.env.SHELL; L293: if (shell?.startsWith("/")) return shell;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main/daemon/server.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = porcelain-daemon@0.28.3 matchedIdentity = npm:cG9yY2VsYWluLWRhZW1vbg:0.28.3 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-CNV5T6nq.jsView file

•path = renderer/assets/index-CNV5T6nq.js kind = oversized_source_file sizeBytes = 5799810 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-CNV5T6nq.jsView on unpkg

Source & flagged code

8 flagged

main/cli/porcelain.jsView file

Lines 1-21javascript

1"use strict";

2const node_child_process = require("node:child_process");

3const node_fs = require("node:fs");

High

Child Process

Package source references child process execution.

main/cli/porcelain.jsView on unpkg · L1

4const node_path = require("node:path");

5const node_crypto = require("node:crypto");

6const node_os = require("node:os");

7function isRecord$a(value) {

8 return typeof value === "object" && value !== null;

9}

10function actionsPath() {

11 return process.env.PORCELAIN_ACTIONS ?? node_path.join(node_os.homedir(), ".porcelain", "actions.json");

12}

13function parseActions(value) {

14 if (!Array.isArray(value)) return [];

15 const actions = [];

16 for (const item of value) {

17 if (!isRecord$a(item)) continue;

18 if (typeof item.id !== "string" || typeof item.title !== "string" || typeof item.command !== "string") {

19 continue;

20 }

21 const action = {

main/chunks/index-BlxZmzlT.jsView file

Lines 2597-2637javascript

2597 external = {

2598 Promise: ES6Promise

2599 };

2600 return external;

2601}

2602var setImmediate$1 = {};

2603var hasRequiredSetImmediate;

2604function

bin/porcelain-daemon.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Headless CLI for the published porcelain-daemon package.

3// Copied into dist-daemon/bin/ by scripts/build-daemon-dist.mjs — not run from

4// the monorepo root (paths resolve relative to the installed package layout).

5//

6// Goal: t3-style one-liner on a remote box —

7// npx porcelain-daemon@latest serve --tailnet

8// instead of scp'ing a dist tarball and wiring systemd.

9

10const { randomBytes

main/daemon/server.jsView file

Lines 1-23javascript

1"use strict";

2const node_crypto = require("node:crypto");

3const zod = require("zod");

4const node_child_process

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

renderer/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

renderer/assets/index-CNV5T6nq.jsView file

•path = renderer/assets/index-CNV5T6nq.js kind = oversized_source_file sizeBytes = 5799810 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

renderer/assets/index-CNV5T6nq.jsView on unpkg