project-knowledge: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

project-knowledge: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/project-knowledge.jsView file

7const path = require('path'); L8: const { spawn, exec, execSync } = require('child_process'); L9: const { existsSync, readFileSync, writeFileSync, unlinkSync } = require('fs');

High

Child Process

Package source references child process execution.

bin/project-knowledge.jsView on unpkg · L7

7const path = require('path'); L8: const { spawn, exec, execSync } = require('child_process'); L9: const { existsSync, readFileSync, writeFileSync, unlinkSync } = require('fs'); L10: const net = require('net'); L11: const os = require('os'); ... L15: const pkg = require('../package.json'); L16: const DEFAULT_PORT = parseInt(process.env.KB_SITE_PORT || '5757', 10); L17: const PORT_RANGE = 20;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/project-knowledge.jsView on unpkg · L7

6L7: const path = require('path'); L8: const { spawn, exec, execSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/project-knowledge.jsView on unpkg · L6

_site/lib/context-pack-builder.jsView file

19const PACKAGE_CONFIG_FILES = [ L20: 'package.json', 'package-lock.json', 'pnpm-workspace.yaml', 'pnpm-lock.yaml', L21: 'tsconfig.json', 'tsconfig.base.json', 'pyproject.toml', 'setup.py', 'requirements.txt', ... L56: } L57: const text = buf.toString('utf-8'); L58: if (text.length > MAX_EXCERPT_BYTES) { ... L207: if (r.ok) { L208: for (const line of (r.stdout || '').split('\n')) { L209: const f = line.trim();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

_site/lib/context-pack-builder.jsView on unpkg · L19

_site/server.jsView file

2// Run: node "D:\SanQian.Xu\project-knowledge-base\_site\server.js" L3: // Listens on http://localhost:5757 (override with KB_SITE_PORT env) L4: ... L7: const path = require('path'); L8: const { spawn, exec } = require('child_process'); L9: const { getAdapter, listAdapters, validateCommitBatchOutput } = require('./lib/ai-adapter'); ... L52: L53: const KB_ROOT = path.resolve(__dirname, '..'); L54: const SITE_ROOT = __dirname; L55: const dataDir = require('./lib/data-dir'); L56: const PORT = parseInt(process.env.KB_SITE_PORT || '5757', 10); L57: const HOST = process.env.KB_SITE_HOST || '127.0.0.1';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

_site/server.jsView on unpkg · L2

_site/_test/package-startup-test.jsView file

73fs.mkdirSync(repoPath, { recursive: true }); L74: let result = spawnSync('git', ['init'], { cwd: repoPath, encoding: 'utf-8' }); L75: assert(result.status === 0, 'git init should succeed: ' + result.stderr); L76: spawnSync('git', ['config', 'user.email', 'kb-test@example.com'], { cwd: repoPath, encoding: 'utf-8' }); ... L85: async function requestJson(method, url, body) { L86: const res = await fetch(`${BASE_URL}${url}`, { L87: method, L88: headers: body ? { 'Content-Type': 'application/json' } : undefined, L89: body: body ? JSON.stringify(body) : undefined, L90: });

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

_site/_test/package-startup-test.jsView on unpkg · L73

_site/start.batView file

•path = _site/start.bat kind = build_helper sizeBytes = 647 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_site/start.batView on unpkg

_site/_test/hook-trigger-test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = project-knowledge@4.1.3 matchedIdentity = npm:cHJvamVjdC1rbm93bGVkZ2U:4.1.3 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

_site/_test/hook-trigger-test.jsView on unpkg

Source & flagged code

8 flagged

bin/project-knowledge.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3// project-knowledge CLI — start in background by default (auto-opens browser).

4// Pattern modeled on tokmeter's bin.js: detached child + PID file + port fallback.

5// Run `project-knowledge --help` for usage.

6

7const path = require('path');

8const { spawn, exec, execSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/project-knowledge.jsView on unpkg · L6

9const { existsSync, readFileSync, writeFileSync, unlinkSync } = require('fs');

High

Child Process

Package source references child process execution.

bin/project-knowledge.jsView on unpkg · L7

10const net = require('net');

11const os = require('os');

12const { getDataDir } = require('../_site/lib/data-dir');

13const runtimeEndpoint = require('../_site/lib/runtime-endpoint');

14

15const pkg = require('../package.json');

16const DEFAULT_PORT = parseInt(process.env.KB_SITE_PORT || '5757', 10);

17const PORT_RANGE = 20;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/project-knowledge.jsView on unpkg · L7

18const PID_FILE = path.join(os.tmpdir(), '.project-knowledge.pid');

19const DATA_DIR = getDataDir();

20

21function readPid() {

22 try {

23 if (!existsSync(PID_FILE)) return null;

24 const lines = readFileSync(PID_FILE, 'utf8').trim().split('\n');

25 return parseInt(lines[0], 10);

26 } catch { return null; }

27}

_site/lib/context-pack-builder.jsView file

Lines 1-39javascript

1// Context Pack Builder (TASK-006)

2// Collects Git diff / stats, project goal, related module/change docs,

3// package/config files, neighbouring source, and tests into a machine-readable

4// context pack written to _site/_ai/<slug>/context-packs/<run-id>/.

5//

6// Path safety: every path is normalized and verified to live inside the project root

7// before it is added to the pack. Outside-the-project paths are rejected.

8

9const fs =

_site/server.jsView file

Lines 1-22javascript

1// KB management site server — zero npm deps (Node built-ins only).

2// Run: node "D:\SanQian.Xu\project-knowledge-base\_site\server.js"

3// Listens on http://localhost:5757 (override with KB_SITE_PORT env)

4

5const http = require('http');

6const fs = require

_site/_test/package-startup-test.jsView file

Lines 53-93javascript

53async function withServer(fn) {

54 const child = spawn(process.execPath, [BIN, '--fg', '--port', PORT, '--host',

_site/start.batView file

•path = _site/start.bat kind = build_helper sizeBytes = 647 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_site/start.batView on unpkg

_site/_test/hook-trigger-test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = project-knowledge@4.1.3 matchedIdentity = npm:cHJvamVjdC1rbm93bGVkZ2U:4.1.3 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

_site/_test/hook-trigger-test.jsView on unpkg