port-authority-agent-terminal-mcp: Suspicious npm security report | LPM Firewall

Loading npm security reports…

port-authority-agent-terminal-mcp: Suspicious npm security report | LPM Firewall

dist/src/core/pagejs.jsView file

Lines 1-38javascript

1/**

2 * In-page JavaScript snippets shared by BOTH page-control drivers (BiDi for

3 * Firefox, CDP for Chrome/Edge). Every snippet is a single EXPRESSION that

4 * evaluates to a JSON string, so both protocols get back `{type:"string"}`

5 * and the driver just JSON.parses it — identical semantics in every browser.

6 *

7 * All user-supplied fragments (selectors, values, expressions) are embedded

8 * via JSON.stringify so quotes/backslashes/newlines can never break out of

9 * the generated code.

10 */

11/** Embed a user string safely inside generated JS. */

12function lit(value) {

13 return JSON.stringify(value);

14}

15/** Guard: every expression we build must parse as valid JS. Catches

16 * generator bugs (unbalanced braces etc.) before they reach a browser. */

17export function assertParses(expr) {

18 // new Function only PARSES here — nothing is executed.

19 new Function(`return (${expr});`);

20 return expr;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/pagejs.jsView on unpkg · L18

21}

22/** Page metadata: url, title, readyState. */

23export function metaExpr() {

24 return assertParses(`JSON.stringify({ url: location.href, title: document.title, readyState: document.readyState })`);

25}

26/** Visible text of the page (or of the first element matching `selector`),

27 * trimmed and capped so a huge page can't flood the agent's context. */

28export function textExpr(selector, maxChars) {

29 const target = selector === undefined ? "document.body" : `document.querySelector(${lit(selector)})`;

30 return assertParses(`JSON.stringify((() => {

31 const el = ${target};

32 if (!el) return { found: false, text: "" };

33 const t = (el.innerText ?? el.textContent ?? "").trim();

34 return { found: true, truncated: t.length > ${maxChars}, text: t.slice(0, ${maxChars}) };

35 })())`);

36}

37/** Click the first element matching `selector` (scrolls it into view first). */

38export function clickExpr(selector) {

scripts/build-dashboard-tauri.cjsView file

Lines 11-51javascript

11 * we don't want .msi/.dmg installers — npm is the install mechanism.

12 * 4. Copy the produced binary to bin/<binary-name> so the npm package can

13 * ship it. Naming:

14 * Windows: bin/paat-dashboard.exe

15 * macOS: bin/paat-dashboard-darwin-<arch>

16 * Linux: bin/paat-dashboard-linux-<arch>

17 *

18 * Why a Node wrapper around `cargo tauri`:

19 * - npm scripts can't cross-platform detect whether cargo is installed.

20 * - We want a readable message when the toolchain is missing.

21 * - We need to copy the produced binary out of target/release/ into bin/.

22 * - The committed bin/paat-dashboard.exe is the source of truth for

23 * Windows releases — this script only needs to run when the Rust /

24 * frontend source changes.

25 *

26 * Force a fail (useful in CI to verify the binary is up-to-date with

27 * source) by passing --strict.

28 */

29

30"use strict";

31

32const { spawnSync } = require("node:child_process");

33const path = require("node:path");

34const fs = require("node:fs");

35const os = require("node:os");

36

37const repoRoot = path.resolve(__dirname, "..");

38const guiDir = path.join(repoRoot, "gui");

39const cargoTargetDir = path.join(guiDir, "src-tauri", "target", "release");

40const binDir = path.join(repoRoot, "bin");

41

42const strict = process.argv.includes("--strict");

43

44function log(msg) { process.stdout.write(`[build-dashboard] ${msg}\n`); }

45function warn(msg) { process.stderr.write(`[build-dashboard] ${msg}\n`); }

46

47/** Resolve the platform-correct executable name for npm + cargo. Node

48 * doesn't auto-append .cmd on Windows when shell:false, so we have to. */

49function npmCmd() { return process.platform === "win32" ? "npm.cmd" : "npm"; }

50function cargoCmd() { return process.platform === "win32" ? "cargo.exe" : "cargo"; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/build-dashboard-tauri.cjsView on unpkg · L31

51