portable-agent-layer@0.61.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

portable-agent-layer@0.61.1: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

assets/skills/playwright/tools/shot.tsView file

14L15: import { spawnSync } from "node:child_process"; L16: import { existsSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

assets/skills/playwright/tools/shot.tsView on unpkg · L14

assets/skills/consulting-report/tools/dev.tsView file

30stdio: "inherit", L31: shell: true, L32: });

High

Shell

Package source references shell execution.

assets/skills/consulting-report/tools/dev.tsView on unpkg · L30

assets/skills/consulting-report/tools/generate-pdf.tsView file

87} L88: const mod = (await import(pathToFileURL(dataPath).href)) as { L89: reportData?: ReportMeta;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

assets/skills/consulting-report/tools/generate-pdf.tsView on unpkg · L87

src/cli/index.tsView file

1057log.info("Installing dependencies..."); L1058: const deps = spawnSync("bun", ["install", "--frozen-lockfile"], { L1059: cwd: pkg, ... L1063: if (deps.status !== 0) { L1064: log.warn("bun install failed — continuing anyway, but hooks may not work"); L1065: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli/index.tsView on unpkg · L1057

assets/statusline.ps1View file

•path = assets/statusline.ps1 kind = build_helper sizeBytes = 9857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/statusline.ps1View on unpkg

src/hooks/handlers/update-check.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = portable-agent-layer@0.60.0 matchedIdentity = npm:cG9ydGFibGUtYWdlbnQtbGF5ZXI:0.60.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/hooks/handlers/update-check.tsView on unpkg

Source & flagged code

6 flagged

assets/skills/playwright/tools/shot.tsView file

Lines 1-34typescript

1#!/usr/bin/env node

2// playwright skill tool: capture a screenshot of a URL and print its absolute path.

3//

4// Engine selection (see chooseTier):

5// Tier 1 — system `playwright-cli` binary (Microsoft's stateful agent CLI), when on

6// PATH and no exact viewport/full-page is requested.

7// Tier 2 — PAL-installed Playwright, launched via Node. (Playwright's chromium.launch

8// hangs under Bun on Windows — the same Node exception create-pdf relies on.)

9// If neither engine works, prints NO_PLAYWRIGHT_CLI on stderr and exits non-zero so the

10// caller (SKILL.md) can fall back to the Playwright MCP.

11//

12// Run with Node:

13// node --experimental-strip-types ~/.pal/skills/playwright/tools/shot.ts <url> [opts]

14

15import { spawnSync } from "node:child_process";

16import { existsSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

assets/skills/playwright/tools/shot.tsView on unpkg · L14

17import { tmpdir } from "node:os";

18import { join, resolve } from "node:path";

19import { chooseTier, parseArgs, type ShotOptions } from "./shot-lib.ts";

20

21function playwrightCliAvailable(): boolean {

22 try {

23 return spawnSync("playwright-cli", ["--version"], { stdio: "ignore" }).status === 0;

24 } catch {

25 return false;

26 }

27}

28

29function runViaCli(opts: ShotOptions, out: string): boolean {

30 // playwright-cli writes a `.playwright-cli/` session dir (logs + page snapshots)

31 // into its cwd. Run it inside a throwaway temp dir so nothing lands in the user's

32 // repo, then remove it. `out` is already absolute, so the screenshot is unaffected.

33 // Cross-platform: os.tmpdir + fs.mkdtemp/rm — no shell, no platform-specific paths.

34 const work = mkdtempSync(join(tmpdir(), "pal-pwcli-"));

assets/skills/consulting-report/tools/dev.tsView file

Lines 10-48typescript

10import { access } from "node:fs/promises";

11import { join, resolve } from "node:path";

12

13async function exists(p: string)

assets/skills/consulting-report/tools/generate-pdf.tsView file

Lines 67-107typescript

67 publicPath: string | undefined

68): Promise<string | null> {

69 if (!publicPath) return null;

70 const filePath =

src/cli/index.tsView file

Lines 1037-1077typescript

1037 const health = doctor(false);

1038 if (!health.hasAgent) {

1039 process.exit(1);

1040 }

1041

assets/statusline.ps1View file

•path = assets/statusline.ps1 kind = build_helper sizeBytes = 9857 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/statusline.ps1View on unpkg

src/hooks/handlers/update-check.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = portable-agent-layer@0.60.0 matchedIdentity = npm:cG9ydGFibGUtYWdlbnQtbGF5ZXI:0.60.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/hooks/handlers/update-check.tsView on unpkg