process-ai@0.9.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

process-ai@0.9.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/docs-site/vendor/d3/7/d3.min.jsView file

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock L2: !function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"!=typeof globalThis?globa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

scripts/docs-site/vendor/d3/7/d3.min.jsView on unpkg · L1

dist/toolkit/adapters/claude-code/skill-copy.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. let lstatprogress = targetprojectdir; for (const seg of path.relative(targetprojectdir, targetskilldir).split(path.sep).filter(boolean)) { lstatprogress = path.join(lstatprogress, seg); try { if ((await fs.lstat(lstatprogress)).issymboliclink()) { throw new error(`recusa: componente do caminho é um symlink (escaparia do escopo do alvo): ${lstatprogress}`); } } catch (e) { if (e.code !== 'enoent') throw e; } } await fs.mkdir(targetskilldir, { recursive: true }); try { const destlstat = aw

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/toolkit/adapters/claude-code/skill-copy.jsView on unpkg

scripts/ingest_csv.pyView file

•path = scripts/ingest_csv.py kind = build_helper sizeBytes = 4500 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ingest_csv.pyView on unpkg

dist/bin/process-ai.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/process-ai.jsView on unpkg

scripts/docs-site/vendor/echarts/5.5.0/echarts.min.jsView file

•matchType = normalized_sha256 matchedPackage = process-ai@0.10.0 matchedPath = scripts/docs-site/vendor/echarts/5.5.0/echarts.min.js matchedIdentity = npm:cHJvY2Vzcy1haQ:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/docs-site/vendor/echarts/5.5.0/echarts.min.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 15-55json

15 "bin/postinstall.js",

16 "skills/",

17 "method-packs/",

18 "scripts/ingest_pdf.py",

19 "scripts/ingest_docx.py",

20 "scripts/ingest_pptx.py",

21 "scripts/ingest_xlsx.py",

22 "scripts/ingest_csv.py",

23 "scripts/ingest_xml.py",

24 "scripts/ingest_common.py",

25 "scripts/requirements-ingest.txt",

26 "scripts/bpmn-renderer/render.ts",

27 "scripts/bpmn-renderer/render.html",

28 "scripts/docs-site/",

29 "README.md",

30 "LICENSE"

31 ],

32 "scripts": {

33 "build": "tsc -p tsconfig.build.json",

34 "prepublishOnly": "npm run build",

35 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "dev": "node bin/process-ai.ts",

37 "test": "node --test tests/*.test.ts",

38 "typecheck": "tsc --noEmit"

39 },

40 "keywords": [

41 "process-mapping",

42 "bpmn",

43 "sipoc",

44 "process-discovery",

45 "claude-code",

46 "agent-pipeline",

47 "hexagonal-architecture",

48 "business-process",

49 "pop",

50 "confidence-markers",

51 "document-ingestion",

52 "pdf-to-markdown",

53 "reference-material"

54 ],

55 "author": "Sandoval Medeiros",

scripts/docs-site/vendor/d3/7/d3.min.jsView file

Lines 1-3javascript

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&

dist/toolkit/adapters/claude-code/skill-copy.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. let lstatprogress = targetprojectdir; for (const seg of path.relative(targetprojectdir, targetskilldir).split(path.sep).filter(boolean)) { lstatprogress = path.join(lstatprogress, seg); try { if ((await fs.lstat(lstatprogress)).issymboliclink()) { throw new error(`recusa: componente do caminho é um symlink (escaparia do escopo do alvo): ${lstatprogress}`); } } catch (e) { if (e.code !== 'enoent') throw e; } } await fs.mkdir(targetskilldir, { recursive: true }); try { const destlstat = aw

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/toolkit/adapters/claude-code/skill-copy.jsView on unpkg

scripts/ingest_csv.pyView file

•path = scripts/ingest_csv.py kind = build_helper sizeBytes = 4500 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ingest_csv.pyView on unpkg

dist/bin/process-ai.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/process-ai.jsView on unpkg

scripts/docs-site/vendor/echarts/5.5.0/echarts.min.jsView file

•matchType = normalized_sha256 matchedPackage = process-ai@0.10.0 matchedPath = scripts/docs-site/vendor/echarts/5.5.0/echarts.min.js matchedIdentity = npm:cHJvY2Vzcy1haQ:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/docs-site/vendor/echarts/5.5.0/echarts.min.jsView on unpkg