qyra-cli: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

qyra-cli: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = bash track.sh completed || echo 'skipping postinstall'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = bash track.sh started || echo 'skipping preinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash track.sh completed || echo 'skipping postinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/dbt/targets/redshift.jsView file

166patternName = generic_password severity = medium line = 166

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dbt/targets/redshift.jsView on unpkg · L166

dist/dbt/schema.jsView file

3package = qyra-cli; repositoryIdentity = qyra; dependency = @qyra/common L3: exports.searchForModel = void 0; L4: const common_1 = require("@qyra/common"); L5: const fs_1 = require("fs");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/dbt/schema.jsView on unpkg · L3

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View on unpkg

dist/dbt/targets/postgres.jsView file

119patternName = generic_password severity = medium line = 119

Medium

Secret Pattern

Hardcoded password in dist/dbt/targets/postgres.js

dist/dbt/targets/postgres.jsView on unpkg · L119

Source & flagged code

8 flagged

package.jsonView file

Lines 16-57json

16 "files": [

17 "dist/**/*",

18 "track.sh",

19 "entitlements.plist"

20 ],

21 "scripts": {

22 "test": "vitest run --config vitest.config.ts",

23 "test:dev": "vitest watch --config vitest.config.ts --changed",

24 "dev": "tsx src/index.ts",

25 "build": "tsc --build tsconfig.json",

26 "postbuild": "copyfiles --all -u 5 \"../../sandboxes/data-apps/template/**/*\" dist/vendor/template && copyfiles --all -u 4 \"src/handlers/apps/authoring/**/*\" dist/vendor/authoring",

27 "bundle": "ncc build dist/index.js -o bundle -e @duckdb/node-api -e @duckdb/node-bindings -e @duckdb/node-bindings-darwin-arm64 -e @duckdb/node-bindings-darwin-x64 -e @duckdb/node-bindings-linux-arm64 -e @duckdb/node-bindings-linux-x64 -e @duckdb/node-bindings-win32-x64 && bash ./scripts/copy-bundle-assets.sh",

28 "build:binary": "DUCKDB_BINDINGS=node-bindings-darwin-x64,node-bindings-darwin-arm64 pnpm bundle && npx @yao-pkg/pkg bundle/index.js --config pkg.config.json --targets node24-macos-x64,node24-macos-arm64 --output bin/qyra --compress Brotli",

29 "typecheck": "tsc --project tsconfig.json --noEmit",

30 "linter": "oxlint -c .oxlintrc.json --ignore-path ./../../.gitignore",

31 "formatter": "oxfmt",

32 "lint": "pnpm run linter ./src",

33 "fix-lint": "pnpm run linter ./src --fix",

34 "format": "oxfmt ./src --check",

35 "fix-format": "oxfmt ./src",

36 "preinstall": "bash track.sh started || echo 'skipping preinstall'",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "postinstall": "bash track.sh completed || echo 'skipping postinstall'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "release": "pnpm publish --no-git-checks --access public"

39 },

40 "dependencies": {

41 "@actions/core": "1.11.1",

42 "@aws-sdk/credential-providers": "3.995.0",

43 "@casl/ability": "6.8.0",

44 "@qyra/common": "npm:qyra-common@2.134.2",

45 "@qyra/warehouses": "npm:qyra-warehouses@2.134.2",

46 "@sidvind/better-ajv-errors": "7.0.0",

47 "@types/columnify": "1.5.1",

48 "ajv": "8.18.0",

49 "ajv-formats": "2.1.1",

50 "chalk": "4.1.2",

51 "chokidar": "3.6.0",

52 "columnify": "1.6.0",

53 "commander": "9.5.0",

54 "execa": "5.1.1",

55 "google-auth-library": "10.7.0",

56 "inquirer": "8.2.7",

57 "js-yaml": "4.3.0",

dist/dbt/targets/redshift.jsView file

Lines 146-186javascript

146 user: target.user ?? '',

147 port: target.port,

148 dbname,

149 schema: target.schema,

150 keepalivesIdle: target.keepalives_idle,

151 sslmode

dist/dbt/schema.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.searchForModel = void 0;

4const common_1 =

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View on unpkg

dist/dbt/targets/postgres.jsView file

Lines 99-139javascript

99 let sslkeyFile;

100 let sslrootcertFile;

101 if (target.sslmode === 'verify-full') {

102 if (!target.sslcert || !target.sslkey ||