sneakoscope@8.1.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

sneakoscope@8.1.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/bin/sks.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/bin/sks.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/codex/managed-proxy-env.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = parsed.p...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/core/codex/managed-proxy-env.jsView on unpkg · L43

dist/core/fsx.jsView file

5import crypto from 'node:crypto'; L6: import { spawn } from 'node:child_process'; L7: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/fsx.jsView on unpkg · L5

dist/core/release/release-gate-batch-runner.jsView file

59return new Promise((resolve) => { L60: const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'ignore', 'ignore'], detached: process.platform !== 'win32' }); L61: let timedOut = false;

High

Shell

Package source references shell execution.

dist/core/release/release-gate-batch-runner.jsView on unpkg · L59

dist/core/super-search/doctor.jsView file

84const smokeModule = './local-http-smoke.js'; L85: const smokeRuntime = await import(smokeModule); L86: const runner = smokeRuntime['run' + 'SuperSearchLocalHttpSmoke'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/super-search/doctor.jsView on unpkg · L84

dist/core/codex-lb/desktop-controller.jsView file

2import fsp from 'node:fs/promises'; L3: import net from 'node:net'; L4: import os from 'node:os'; ... L723: const envTimeout = Number(input.env?.SKS_CODEX_LB_IMAGE_PROBE_TIMEOUT_MS L724: || process.env.SKS_CODEX_LB_IMAGE_PROBE_TIMEOUT_MS L725: || 0); ... L1048: } L1049: const home = input.home || input.env?.HOME || process.env.HOME || os.homedir(); L1050: const receiptDir = input.receiptDir || codexLbMigrationReceiptDir(home); ... L1231: } L1232: const key = randomBytes(16).toString('base64'); L1233: const expectedAccept = createHash('sha1')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/codex-lb/desktop-controller.jsView on unpkg · L2

dist/core/install/installed-package-smoke.jsView file

36const stubBin = path.join(tmp, 'bin'); L37: const launchctlLog = path.join(tmp, 'launchctl-calls.log'); L38: const launchctlStub = path.join(stubBin, process.platform === 'win32' ? 'launchctl.cmd' : 'launchctl'); L39: const npmUserConfig = path.join(tmp, 'npmrc'); ... L133: TMPDIR: runtimeTmp, L134: PATH: `${stubBin}${path.delimiter}${String(process.env.PATH || '')}`, L135: NODE_DISABLE_COMPILE_CACHE: '1', ... L159: const packageLocalStampPresent = await regularFileExists(packageLocalStamp); L160: const installOutput = `${install.stdout}\n${install.command.stderr_tail}`; L161: const optInGuidancePresent = /Automatic bootstrap was not run/.test(installOutput) ... L314: try { L315: const parsed = JSON.parse(await fs.readFile(receipt, 'utf8'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/install/installed-package-smoke.jsView on unpkg · L36

dist/cli/command-manifest-lite.jsView file

91Install-time code directly mutates a foreign AI-agent control surface: L91: { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, L92: { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' }, L93: { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', sk[redacted]: true, allowedDuringActiveRoute: true, diagnostic: true }, Write operation from dist/commands/doctor.js: L94: migration = { L95: schema: 'sk[redacted]', L96: ok: false, ... L156: const status = input.providerStatus || {}; L157: const configPath = String(status.config_path || path.join(home, '.codex', 'config.toml')); L158: const configText = await (d

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/command-manifest-lite.jsView on unpkg · L91

dist/scripts/check-runtime-schemas.jsView file

7const root = process.cwd(); L8: const tsc = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['tsc', '-p', 'tsconfig.json', '--noEmit'], { L9: cwd: root,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/check-runtime-schemas.jsView on unpkg · L7

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView file

•path = dist/native/sks-[redacted].pdf kind = high_entropy_blob sizeBytes = 8488 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/native/sks-menubar/Resources/SKSStatusAttentionTemplate.pdfView on unpkg

dist/core/release/release-cache-key.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/release/release-cache-key.jsView on unpkg

dist/core/codex-control/codex-current-feature-probes.jsView file

•matchType = normalized_sha256 matchedPackage = sneakoscope@6.5.1 matchedPath = dist/core/codex-control/codex-0140-feature-probes.js matchedIdentity = npm:c25lYWtvc2NvcGU:6.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/codex-control/codex-current-feature-probes.jsView on unpkg

dist/core/mcp-config/health-check.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sneakoscope@8.3.2 matchedIdentity = npm:c25lYWtvc2NvcGU:8.3.2 similarity = 0.542 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/mcp-config/health-check.jsView on unpkg