replicas-engine@0.1.960: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

replicas-engine@0.1.960: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

dist/src/chunk-BMC4R5IZ.jsView file

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts L319: import { spawnSync } from "child_process"; L320: import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

407const result = spawnSync(value.slice(1), { L408: shell: true, L409: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L407

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

88SUBPROCESS_MAX_BUFFER, L89: execAsync, L90: execFileAsync ... L456: var B = (t, e) => { L457: let { pathExt: r = process.env.PATHEXT || "" } = e, s = r.split(D.delimiter); L458: if (s.indexOf("") !== -1) return true; ... L508: X(p(), exports); L509: var H = process.env._ISEXE_TEST_PLATFORM_ || process.platform; L510: var b = H === "win32" ? O : E; ... L532: // windows always checks the cwd first L533: ...isWindows ? [process.cwd()] : [], L534: ...(optPath || /* istanbul ignore next: very unusual */

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/src/index.jsView on unpkg · L88

31230if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L31231: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L31232: this.scope.value(validateName, { ref: validate });

High

Eval

Package source references dynamic code evaluation.

dist/src/index.jsView on unpkg · L31230

49106function envKillSwitch(name) { L49107: const value = process.env[name]?.trim().toLowerCase(); L49108: if (!value) return void 0; ... L49119: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49120: import { execFile as execFile6 } from "child_process"; L49121: import { randomUUID as randomUUID9 } from "crypto"; L49122: import net from "net"; L49123:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-3TPGWE3O.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-3TPGWE3O.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg

Source & flagged code

14 flagged

dist/src/chunk-BMC4R5IZ.jsView file

Lines 298-338javascript

298}

299function readPiConfig() {

300 const dir = process.env.PI_PACKAGE_DIR?.trim();

301 if (!dir) return void 0;

302 try {

303 const manifest = JSON.parse(readFileSync(join(resolve(dir), "package.json"), "utf8"));

304 return manifest.piConfig;

305 } catch {

306 return void 0;

307 }

308}

309function getAppName() {

310 const name = readPiConfig()?.name;

311 return typeof name === "string" && name.trim() ? name.trim() : "pi";

312}

313function getAppClientUri() {

314 const uri = readPiConfig()?.clientUri;

315 return typeof uri === "string" && uri.trim() ? uri.trim() : void 0;

316}

317

318// ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/utils.ts

319import { spawnSync } from "child_process";

320import { homedir as homedir2, platform } from "os";

High

Child Process

Package source references child process execution.

dist/src/chunk-BMC4R5IZ.jsView on unpkg · L318

321import { extname, isAbsolute, join as join2 } from "path";

322async function execOpen(pi, target, browser, signal) {

323 const os2 = platform();

324 if (os2 === "darwin") {

325 if (browser) {

326 return isAbsolute(browser) && extname(browser).toLowerCase() !== ".app" ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("open", ["-a", browser, target], signal ? { signal } : {});

327 }

328 return pi.exec("open", [target], signal ? { signal } : {});

329 }

330 if (os2 === "win32") {

331 return browser ? pi.exec("cmd", ["/c", "start", "", browser, target], signal ? { signal } : {}) : pi.exec("cmd", ["/c", "start", "", target], signal ? { signal } : {});

332 }

333 return browser ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("xdg-open", [target], signal ? { signal } : {});

334}

335async function openUrl(pi, url, browser, signal) {

336 const result = await execOpen(pi, url, browser, signal);

337 if (result.code !== 0) {

338 throw new Error(result.stderr || `Failed to open browser (exit code ${result.code})`);

Lines 387-427javascript

387 }

388 return Object.keys(result).length > 0 ? result : void 0;

389}

390function interpolateSecretExpression(value, environment

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-BMC4R5IZ.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-BMC4R5IZ.jsView on unpkg

dist/src/index.jsView file

88SUBPROCESS_MAX_BUFFER, L89: execAsync, L90: execFileAsync ... L456: var B = (t, e) => { L457: let { pathExt: r = process.env.PATHEXT || "" } = e, s = r.split(D.delimiter); L458: if (s.indexOf("") !== -1) return true; ... L508: X(p(), exports); L509: var H = process.env._ISEXE_TEST_PLATFORM_ || process.platform; L510: var b = H === "win32" ? O : E; ... L532: // windows always checks the cwd first L533: ...isWindows ? [process.cwd()] : [], L534: ...(optPath || /* istanbul ignore next: very unusual */

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/src/index.jsView on unpkg · L88

31230if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L31231: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L31232: this.scope.value(validateName, { ref: validate });

High

Eval

Package source references dynamic code evaluation.

dist/src/index.jsView on unpkg · L31230

49106function envKillSwitch(name) { L49107: const value = process.env[name]?.trim().toLowerCase(); L49108: if (!value) return void 0; ... L49119: // ../node_modules/.bun/pi-mcp-adapter@2.32.1+04b0d7b0bc944965/node_modules/pi-mcp-adapter/ui-session.ts L49120: import { execFile as execFile6 } from "child_process"; L49121: import { randomUUID as randomUUID9 } from "crypto"; L49122: import net from "net"; L49123:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/engine-watchdog.shView file

•path = scripts/engine-watchdog.sh kind = build_helper sizeBytes = 3671 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/engine-watchdog.shView on unpkg

dist/src/chunk-3TPGWE3O.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/chunk-3TPGWE3O.jsView on unpkg

scripts/gh.cjsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = scripts/gh.cjs matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/gh.cjsView on unpkg

dist/src/chunk-UHBYG6JY.jsView file

•matchType = normalized_sha256 matchedPackage = replicas-engine@0.1.804 matchedPath = dist/src/chunk-UHBYG6JY.js matchedIdentity = npm:cmVwbGljYXMtZW5naW5l:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/chunk-UHBYG6JY.jsView on unpkg