punchcard-presence@1.0.8: AI-agent control-surface risk

Loading npm security reports…

Source & flagged code

12 flagged

package.jsonView file

Lines 1-34json

2 "name": "punchcard-presence",

3 "version": "1.0.8",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts/postinstall.cjs",

20 "scripts/tray.ps1",

21 "scripts/tray-macos.js",

22 "docs/MACOS.md",

23 "docs/PRIVACY.md",

24 "README.md",

25 "LICENSE",

26 "CHANGELOG.md"

27 ],

28 "keywords": [

29 "discord",

30 "rich-presence",

31 "punchcard",

32 "ai-usage",

33 "token-usage",

34 "claude-code",

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 175-215javascript

175 if (isPidAlive(savedPid)) return savedPid;

176 if (savedPid) await fs.rm(paths.pid, { force: true });

177 const pid = startDaemonDetached(paths);

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/autostart.jsView file

Lines 1-23javascript

1import fs from "node:fs/promises";

2import os from "node:os";

3import path from "node:path";

4import { execFile } from "node:child_process";

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.jsView file

2import fs from "node:fs/promises"; L3: import { spawn } from "node:child_process"; L4: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

punchcard-presence@1.0.8: AI-agent control-surface risk | LPM Firewall

Source & flagged code

12 flagged

package.jsonView file

Lines 1-34json

2 "name": "punchcard-presence",

3 "version": "1.0.8",

4 "description": "Punchcard Discord Rich Presence and local AI usage tracking for Claude Code and Codex",

5 "type": "module",

6 "bin": {

7 "punchcard": "bin/cli.js"

8 },

9 "scripts": {

10 "test": "node --test",

11 "check": "node tools/check-package.mjs",

12 "release:check": "npm test && npm run check && node tools/smoke-package.mjs",

13 "prepublishOnly": "npm run release:check",

14 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "lib",

19 "scripts/postinstall.cjs",

20 "scripts/tray.ps1",

21 "scripts/tray-macos.js",

22 "docs/MACOS.md",

23 "docs/PRIVACY.md",

24 "README.md",

25 "LICENSE",

26 "CHANGELOG.md"

27 ],

28 "keywords": [

29 "discord",

30 "rich-presence",

31 "punchcard",

32 "ai-usage",

33 "token-usage",

34 "claude-code",

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import { spawn } from "node:child_process";

4import path from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

lib/tray.jsView file

Lines 175-215javascript

175 if (isPidAlive(savedPid)) return savedPid;

176 if (savedPid) await fs.rm(paths.pid, { force: true });

177 const pid = startDaemonDetached(paths);

scripts/postinstall.cjsView file

Lines 1-8javascript

1const { spawnSync } = require("node:child_process");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L1

lib/autostart.jsView file

Lines 1-23javascript

1import fs from "node:fs/promises";

2import os from "node:os";

3import path from "node:path";

4import { execFile } from "node:child_process";

lib/more-metrics.jsView file

Lines 1-22javascript

1import fs from "node:fs/promises";

2import path from "node:path";

3import { spawn } from "node:child_process";

4import { pathToFileURL } from "node:url";

scripts/tray.ps1View file

•path = scripts/tray.ps1 kind = build_helper sizeBytes = 24892 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/tray.ps1View on unpkg

punchcard-presence@1.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code