punchcard-presence@1.0.1: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

punchcard-presence@1.0.1: AI-agent control-surface risk | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2import fs from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

•matchType = previous_version_dangerous_delta matchedPackage = punchcard-presence@1.0.0 matchedIdentity = npm:cHVuY2hjYXJkLXByZXNlbmNl:1.0.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

lib/tray.jsView file

50await fs.mkdir(paths.home, { recursive: true }); L51: const child = spawn("powershell.exe", [ L52: "-NoProfile",

High

Shell

Package source references shell execution.

lib/tray.jsView on unpkg · L50

scripts/postinstall.cjsView file

1const { spawnSync } = require("node:child_process"); L2: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/more-metrics.jsView file

2import path from "node:path"; L3: import { spawn } from "node:child_process"; L4: import { pathToFileURL } from "node:url"; ... L8: export const MORE_METRICS_VERSION = "1.0.0"; L9: export const MORE_METRICS_API_BASE_URL = "https://app.theartificialgames.workers.dev"; L10: L11: function packageConfig(env = process.env) { L12: const packageName = String(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/more-metrics.jsView on unpkg · L2

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 22329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "punchcard-presence",

3 "version": "1.0.1",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts",

20 "assets",

21 "README.md",

22 "LICENSE",

23 "CHANGELOG.md",

24 "PRIVACY.md",

25 "SECURITY.md"

26 ],

27 "keywords": [

28 "discord",

29 "rich-presence",

30 "punchcard",

31 "ai-usage",

32 "token-usage",

33 "claude-code",

34 "codex"

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 30-70javascript

30 const child = spawn(process.execPath, [cliPath, "tray-host", ...(options.showOnStart ? ["--show"] : [])], {

31 cwd: paths.home,

32 detached: true,

33 stdio:

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

3

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 22329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg