replicas-engine@0.1.1006: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

replicas-engine@0.1.1006: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

14 flagged · loading source

dist/src/chunk-BMC4R5IZ.jsView file

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts L319: import { spawnSync } from "child_process"; L320: import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

407const result = spawnSync(value.slice(1), { L408: shell: true, L409: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L407

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = replicas-engine@0.1.962 matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.962 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/index.jsView on unpkg

49071function envKillSwitch(name) { L49072: const value = process.env[name]?.trim().toLowerCase(); L49073: if (!value) return void 0; ... L49084: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49085: import { execFile as execFile6 } from "child_process"; L49086: import { randomUUID as randomUUID9 } from "crypto"; L49087: import net from "net"; L49088:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/index.jsView on unpkg · L49071

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/src/index.js: import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises"; async function atomicWriteFile(path7, data, options) { await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode }); await atomicWriteFile(filePath, content, { mode: 384 }); await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 }); await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2)); headers: { Authorization: `Bearer ${token}` }, async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude, allowedMeth

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-7OGI4N7B.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-7OGI4N7B.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg

Source & flagged code

14 flagged

dist/src/chunk-BMC4R5IZ.jsView file

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts L319: import { spawnSync } from "child_process"; L320: import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

407const result = spawnSync(value.slice(1), { L408: shell: true, L409: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L407

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = replicas-engine@0.1.962 matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.962 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/index.jsView on unpkg

49071function envKillSwitch(name) { L49072: const value = process.env[name]?.trim().toLowerCase(); L49073: if (!value) return void 0; ... L49084: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49085: import { execFile as execFile6 } from "child_process"; L49086: import { randomUUID as randomUUID9 } from "crypto"; L49087: import net from "net"; L49088:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/index.jsView on unpkg · L49071

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/src/index.js: import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises"; async function atomicWriteFile(path7, data, options) { await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode }); await atomicWriteFile(filePath, content, { mode: 384 }); await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 }); await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2)); headers: { Authorization: `Bearer ${token}` }, async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude, allowedMeth

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-7OGI4N7B.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-7OGI4N7B.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg