replicas-engine@0.1.1015: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

replicas-engine@0.1.1015: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

14 flagged · loading source

dist/src/chunk-BMC4R5IZ.jsView file

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts L319: import { spawnSync } from "child_process"; L320: import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

407const result = spawnSync(value.slice(1), { L408: shell: true, L409: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L407

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = replicas-engine@0.1.962 matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.962 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/index.jsView on unpkg

49092function envKillSwitch(name) { L49093: const value = process.env[name]?.trim().toLowerCase(); L49094: if (!value) return void 0; ... L49105: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49106: import { execFile as execFile6 } from "child_process"; L49107: import { randomUUID as randomUUID9 } from "crypto"; L49108: import net from "net"; L49109:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/index.jsView on unpkg · L49092

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/src/index.js: import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises"; async function atomicWriteFile(path7, data, options) { await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode }); await atomicWriteFile(filePath, content, { mode: 384 }); await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 }); await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2)); headers: { Authorization: `Bearer ${token}` }, async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude, allowedMeth

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-FS6WYZYI.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-FS6WYZYI.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg

Source & flagged code

14 flagged

dist/src/chunk-BMC4R5IZ.jsView file

Lines 298-338javascript

298}

299function readPiConfig() {

300 const dir = process.env.PI_PACKAGE_DIR?.trim();

301 if (!dir) return void 0;

302 try {

303 const manifest = JSON.parse(readFileSync(join(resolve(dir), "package.json"), "utf8"));

304 return manifest.piConfig;

305 } catch {

306 return void 0;

307 }

308}

309function getAppName() {

310 const name = readPiConfig()?.name;

311 return typeof name === "string" && name.trim() ? name.trim() : "pi";

312}

313function getAppClientUri() {

314 const uri = readPiConfig()?.clientUri;

315 return typeof uri === "string" && uri.trim() ? uri.trim() : void 0;

316}

317

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts

319import { spawnSync } from "child_process";

320import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

321import { extname, isAbsolute, join as join2 } from "path";

322async function execOpen(pi, target, browser, signal) {

323 const os2 = platform();

324 if (os2 === "darwin") {

325 if (browser) {

326 return isAbsolute(browser) && extname(browser).toLowerCase() !== ".app" ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("open", ["-a", browser, target], signal ? { signal } : {});

327 }

328 return pi.exec("open", [target], signal ? { signal } : {});

329 }

330 if (os2 === "win32") {

331 return browser ? pi.exec("cmd", ["/c", "start", "", browser, target], signal ? { signal } : {}) : pi.exec("cmd", ["/c", "start", "", target], signal ? { signal } : {});

332 }

333 return browser ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("xdg-open", [target], signal ? { signal } : {});

334}

335async function openUrl(pi, url, browser, signal) {

336 const result = await execOpen(pi, url, browser, signal);

337 if (result.code !== 0) {

338 throw new Error(result.stderr || `Failed to open browser (exit code ${result.code})`);

Lines 387-427javascript

387 }

388 return Object.keys(result).length > 0 ? result : void 0;

389}

390function interpolateSecretExpression(value, environment

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = replicas-engine@0.1.962 matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.962 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/index.jsView on unpkg

49092function envKillSwitch(name) { L49093: const value = process.env[name]?.trim().toLowerCase(); L49094: if (!value) return void 0; ... L49105: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49106: import { execFile as execFile6 } from "child_process"; L49107: import { randomUUID as randomUUID9 } from "crypto"; L49108: import net from "net"; L49109:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/index.jsView on unpkg · L49092

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/src/index.js: import { mkdir, readFile, rename, unlink, writeFile } from "fs/promises"; async function atomicWriteFile(path7, data, options) { await writeFile(tmpFile, data, { encoding: "utf-8", mode: options?.mode }); await atomicWriteFile(filePath, content, { mode: 384 }); await atomicWriteFile(helperPath, buildGitCredentialHelperScript(credentialsPath), { mode: 448 }); await atomicWriteFile(STATE_FILE, JSON.stringify(nextState, null, 2)); headers: { Authorization: `Bearer ${token}` }, async fetchFreshCredentials(failureReason, failureKind = "rejected", failedCredential = ENGINE_ENV.REPLICAS_AGENT_CREDENTIALS.claude, allowedMeth

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-FS6WYZYI.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-FS6WYZYI.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg