proea-studio@0.8.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

proea-studio@0.8.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist-bin/proea-studio-mcp.jsView file

31634// [redacted].ts L31635: import { spawn as spawn2 } from "child_process"; L31636: import { statSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist-bin/proea-studio-mcp.jsView on unpkg · L31634

1225Cross-file remote execution chain: dist-bin/proea-studio-mcp.js spawns dist-bin/proea-studio.js; helper contains network access plus dynamic code execution. L1225: // validation function arguments L1226: data: new codegen_1.Name("data"), L1227: // data passed to validation function ... L2252: id = normalizeId2(id); L2253: return resolver.resolve(baseId, id); L2254: } ... L3115: for (i = 0; i < input.length; i++) { L3116: code = input[i].charCodeAt(0); L3117: if (code === 48) { ... L22972: var StdioServerTransport = class { L22973: constructor(_stdin = process3.stdin, _stdout = process3.stdout) { L22974: this._stdin = _stdin;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-bin/proea-studio-mcp.jsView on unpkg · L1225

2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-bin/proea-studio-mcp.jsView on unpkg · L2941

dist-bin/proea-studio.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = proea-studio@0.8.0 matchedIdentity = npm:cHJvZWEtc3R1ZGlv:0.8.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-bin/proea-studio.jsView on unpkg

108if (!/ENOENT|EINVAL/i.test(msg)) throw e; L109: const result = await runner.run(cli, argv.map(quoteForShell), { shell: true }); L110: if (result.code !== 0 && (result.code === CMD_NOT_FOUND_EXIT || NOT_RECOGNIZED.test(result.stderr + result.stdout))) {

High

Shell

Package source references shell execution.

dist-bin/proea-studio.jsView on unpkg · L108

Source & flagged code

5 flagged

dist-bin/proea-studio-mcp.jsView file

31634// [redacted].ts L31635: import { spawn as spawn2 } from "child_process"; L31636: import { statSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist-bin/proea-studio-mcp.jsView on unpkg · L31634

1225Cross-file remote execution chain: dist-bin/proea-studio-mcp.js spawns dist-bin/proea-studio.js; helper contains network access plus dynamic code execution. L1225: // validation function arguments L1226: data: new codegen_1.Name("data"), L1227: // data passed to validation function ... L2252: id = normalizeId2(id); L2253: return resolver.resolve(baseId, id); L2254: } ... L3115: for (i = 0; i < input.length; i++) { L3116: code = input[i].charCodeAt(0); L3117: if (code === 48) { ... L22972: var StdioServerTransport = class { L22973: constructor(_stdin = process3.stdin, _stdout = process3.stdout) { L22974: this._stdin = _stdin;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-bin/proea-studio-mcp.jsView on unpkg · L1225

2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-bin/proea-studio-mcp.jsView on unpkg · L2941

dist-bin/proea-studio.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = proea-studio@0.8.0 matchedIdentity = npm:cHJvZWEtc3R1ZGlv:0.8.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-bin/proea-studio.jsView on unpkg

108if (!/ENOENT|EINVAL/i.test(msg)) throw e; L109: const result = await runner.run(cli, argv.map(quoteForShell), { shell: true }); L110: if (result.code !== 0 && (result.code === CMD_NOT_FOUND_EXIT || NOT_RECOGNIZED.test(result.stderr + result.stdout))) {

High

Shell

Package source references shell execution.

dist-bin/proea-studio.jsView on unpkg · L108