scene-capability-engine: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

6 flagged

bin/sce.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3const args = process.argv.slice(2);

4const command = args[0];

5const requestsVersion = args.includes('--version') || args.includes('-V');

6const packageJson = require('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sce.jsView on unpkg · L5

8require('../lib/transition/magicball-transition').displayFirstRunTransitionNotice({

9 version: packageJson.version,

10 args

11});

13if (requestsVersion) {

14 console.log(packageJson.version);

15} else if (command === 'transition' || command === 'migrate-to-magicball') {

16 const transitionCommand = require('../lib/commands/transition');

17 transitionCommand({ json: args.includes('--json') });

18} else {

19 require('./scene-capability-engine');

20}

lib/auto/governance-advisory-service.jsView file

Lines 1-23javascript

1const { resolveLatestRecoverableBatchSummary, resolveLatestPendingControllerSession } = require('./recovery-selection-service');

3async function executeGovernanceAdvisoryRecover(projectPath, options =

template/.sce/tools/quality_scorer.pyView file

•path = template/.sce/tools/quality_scorer.py kind = payload_in_excluded_dir sizeBytes = 11862 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.sce/tools/quality_scorer.pyView on unpkg

•path = template/.sce/tools/quality_scorer.py kind = build_helper sizeBytes = 11862 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.sce/tools/quality_scorer.pyView on unpkg

package.jsonView file

Lines 6-46json

6 "bin": {

7 "sce": "bin/sce.js",

8 "sco": "bin/sco.js"

9 },

10 "files": [

11 "bin/",

Source & flagged code

6 flagged · loading source

bin/sce.jsView file

5const requestsVersion = args.includes('--version') || args.includes('-V'); L6: const packageJson = require('../package.json'); L7:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sce.jsView on unpkg · L5

lib/auto/governance-advisory-service.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>async function [redacted](projectPath, options = {}, dependencies = {}) {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/auto/governance-advisory-service.jsView on unpkg · L3

•Trigger-reachable chain: manifest.bin -> bin/sce.js -> bin/scene-capability-engine.js -> lib/commands/auto.js -> lib/auto/governance-advisory-service.js Reachable file contains a blocking source-risk pattern.

scene-capability-engine: Suspicious npm security report (Warn) | LPM Firewall

scene-capability-engine@3.7.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Runtime surface

Behavioral surface

Source & flagged code