sprag-cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sprag-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

7L8: import { spawnSync } from 'node:child_process'; L9: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L7

src/fig2md.cjsView file

31// `0.4.x` rather than `^0.4.1` on purpose: the Windows install goes through L32: // cmd.exe, where `^` is the escape character and would be eaten before npm L33: // ever saw it. The range is the same one caret means for a 0.x package.

High

Shell

Package source references shell execution.

src/fig2md.cjsView on unpkg · L31

src/doc2md.cjsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/doc2md.cjs matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/doc2md.cjsView on unpkg

24L25: const fs = require('node:fs'); L26: const os = require('node:os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/doc2md.cjsView on unpkg · L24

src/seed-rules.jsView file

57try { L58: const data = JSON.parse(readFileSync(seedStatePath(opts), 'utf8')); L59: return data && typeof data.decided === 'object' && data.decided ? data : { decided: {} };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/seed-rules.jsView on unpkg · L57

src/codex-panel-shell.jsView file

34Trigger-reachable persistence chain: manifest.bin -> bin/cli.js -> src/commands/codex.js -> src/codex-panel-shell.js L34: L35: export function installPanelShell({ file = join(process.env.ZDOTDIR || homedir(), '.zshrc'), remove = false } = {}) { L36: const text = existsSync(file) ? readFileSync(file, 'utf8') : '';

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/codex-panel-shell.jsView on unpkg · L34

34L35: export function installPanelShell({ file = join(process.env.ZDOTDIR || homedir(), '.zshrc'), remove = false } = {}) { L36: const text = existsSync(file) ? readFileSync(file, 'utf8') : '';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/codex-panel-shell.jsView on unpkg · L34

src/commands/feedback.jsView file

56if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/commands/feedback.jsView on unpkg · L56

21L22: import { spawnSync } from 'node:child_process'; L23: import { writeFileSync, mkdirSync } from 'node:fs'; ... L28: const REPO = 'rootstudioyaml/sprag'; L29: const ISSUES_URL = `https://github.com/${REPO}/issues`; L30: ... L47: `version: ${version}`, L48: `os: ${process.platform} ${os.release()}`, L49: `node: ${process.version}`, ... L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/feedback.jsView on unpkg · L21

56Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/cli.js -> src/commands/feedback.js L56: if (auth.status !== 0) return null; L57: const res = spawnSync('gh', ['issue', 'create', '-R', REPO, '--title', title, '--body', body], L58: { encoding: 'utf8', timeout: 30_000 }); L59: if (res.status !== 0) { debug('feedback:gh', res.stderr); return null; } L60: const url = String(res.stdout).trim().split('\n').pop(); ... L67: try { L68: const params = new URLSearchParams(); L69: params.set(FORM.message, `${title}\n\n${body}`); L70: params.set(FORM.meta, meta); L71: const res = await fetch(`https://docs.google.com/forms/d/e/${FORM.id}/formResponse`, { L72: method: 'POST',

examples/statusline-command.ps1View file

•path = examples/statusline-command.ps1 kind = build_helper sizeBytes = 1918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/statusline-command.ps1View on unpkg

src/advice.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/advice.js#virtual:normalized:round1View on unpkg

src/codex-panel-setup.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/codex-panel-setup.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-panel-setup.jsView on unpkg

src/korean-style.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/korean-style.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/korean-style.jsView on unpkg

src/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/update-check.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.jsView on unpkg

src/codex-budget.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/codex-budget.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/codex-budget.jsView on unpkg

src/commands/install.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/commands/install.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install.jsView on unpkg

src/model-alias.jsView file

•matchType = normalized_sha256 matchedPackage = sprag-cli@3.56.0 matchedPath = src/model-alias.js matchedIdentity = npm:c3ByYWctY2xp:3.56.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/model-alias.jsView on unpkg