Loading npm security reports…

strikethroo@3.14.2: Suspicious npm security report (Warn) | LPM Firewall

registry / strikethroo / 3.14.2

strikethroo@3.14.2

Task management for AI coding assistants

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 224 file(s), 6.16 MB of source, external domains: base-ui.com, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, openjsf.org, reactjs.org, strikethroo.canpicasoft.com, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

7 flagged

dist/serve/server.jsView file

Lines 39-79javascript

39 var ownKeys = function(o) {

40 ownKeys = Object.getOwnPropertyNames || function (o) {

41 var ar = [];

42 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

43 return ar;

44 };

45 return ownKeys(o);

46 };

47 return function (mod) {

48 if (mod && mod.__esModule) return mod;

49 var result = {};

50 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

51 __setModuleDefault(result, mod);

52 return result;

53 };

54})();

55Object.defineProperty(exports, "__esModule", { value: true });

56exports.startServer = exports.defaultAssetsDir = void 0;

57const http = __importStar(require("http"));

58const fs = __importStar(require("fs"));

59const path = __importStar(require("path"));

60const child_process_1 = require("child_process");

61const url_1 = require("url");

High

Child Process

Package source references child process execution.

dist/serve/server.jsView on unpkg · L59

62const workspace_model_1 = require("./workspace-model");

63const events_1 = require("./events");

64const self_review_1 = require("./self-review");

65const archive_1 = require("./archive");

66const config_write_1 = require("./config-write");

67const MIME_TYPES = {

68 '.html': 'text/html; charset=utf-8',

69 '.js': 'text/javascript; charset=utf-8',

70 '.mjs': 'text/javascript; charset=utf-8',

71 '.css': 'text/css; charset=utf-8',

72 '.json': 'application/json; charset=utf-8',

73 '.svg': 'image/svg+xml',

74 '.png': 'image/png',

75 '.jpg': 'image/jpeg',

76 '.jpeg': 'image/jpeg',

77 '.gif': 'image/gif',

78 '.ico': 'image/x-icon',

79 '.webp': 'image/webp',

templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjsView file

Lines 268-308javascript

268 }

269 if (line.charAt(delim.length + 1) === delim.slice(-1)) {

270 return false

dist/prompts.jsView file

Lines 1-33javascript

1"use strict";

2/**

3 * Interactive Prompts for Conflict Resolution

4 *

5 * This file handles user interaction when file conflicts are detected,

6 * displaying unified diffs and collecting resolution decisions

7 */

8var __importDefault = (this && this

dist-web/assets/cytoscape.esm-BHYC38rz.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/cytoscape.esm-BHYC38rz.jsView on unpkg

dist-web/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/sql-D0XecflT.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/sql-D0XecflT.jsView on unpkg

dist-web/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/serve/server.jsView file

59const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const url_1 = require("url");

High

Child Process

Package source references child process execution.

dist/serve/server.jsView on unpkg · L59

templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjsView file

288Cross-file remote execution chain: templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L288: function createSection() { L289: return { key: "", data: "", content: "" }; L290: } ... L757: if (ch === "_") continue; L758: if (!isHexCode(data.charCodeAt(index))) return false; L759: hasDigits = true; ... L1376: if (ast.body[0].expression.body.type === "BlockStatement") { L1377: return new Function(params, source.slice(body[0] + 1, body[1] - 1)); L1378: } ... L3548: const nodeScript = /\.(?:cjs|mjs|js)$/.test(scriptPath); L3549: const stdout = nodeScript ? (0, import_child_process.execFileSync)(process.execPath, [scriptPath], { L3550: input,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

Findings

6 High5 Medium8 Low

HighChild Processdist/serve/server.js

HighShell

HighCross File Remote Execution Contexttemplates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjs

HighKnown Malware Source Similaritydist-web/assets/cytoscape.esm-BHYC38rz.js

HighKnown Malware Source Similaritydist-web/assets/sql-D0XecflT.js

HighKnown Malware Source Similaritydist-web/assets/vbscript-BuJXcnF6.js

MediumDynamic Requiredist/prompts.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Low

Source & flagged code

7 flagged

dist/serve/server.jsView file

Lines 39-79javascript

39 var ownKeys = function(o) {

40 ownKeys = Object.getOwnPropertyNames || function (o) {

41 var ar = [];

42 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

43 return ar;

44 };

45 return ownKeys(o);

46 };

47 return function (mod) {

48 if (mod && mod.__esModule) return mod;

49 var result = {};

50 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

51 __setModuleDefault(result, mod);

52 return result;

53 };

54})();

55Object.defineProperty(exports, "__esModule", { value: true });

56exports.startServer = exports.defaultAssetsDir = void 0;

57const http = __importStar(require("http"));

58const fs = __importStar(require("fs"));

59const path = __importStar(require("path"));

60const child_process_1 = require("child_process");

61const url_1 = require("url");

High

Child Process

Package source references child process execution.

dist/serve/server.jsView on unpkg · L59

62const workspace_model_1 = require("./workspace-model");

63const events_1 = require("./events");

64const self_review_1 = require("./self-review");

65const archive_1 = require("./archive");

66const config_write_1 = require("./config-write");

67const MIME_TYPES = {

68 '.html': 'text/html; charset=utf-8',

69 '.js': 'text/javascript; charset=utf-8',

70 '.mjs': 'text/javascript; charset=utf-8',

71 '.css': 'text/css; charset=utf-8',

72 '.json': 'application/json; charset=utf-8',

73 '.svg': 'image/svg+xml',

74 '.png': 'image/png',

75 '.jpg': 'image/jpeg',

76 '.jpeg': 'image/jpeg',

77 '.gif': 'image/gif',

78 '.ico': 'image/x-icon',

79 '.webp': 'image/webp',

templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjsView file

Lines 268-308javascript

268 }

269 if (line.charAt(delim.length + 1) === delim.slice(-1)) {

270 return false

dist/prompts.jsView file

Lines 1-33javascript

1"use strict";

2/**

3 * Interactive Prompts for Conflict Resolution

4 *

5 * This file handles user interaction when file conflicts are detected,

6 * displaying unified diffs and collecting resolution decisions

7 */

8var __importDefault = (this && this

dist-web/assets/cytoscape.esm-BHYC38rz.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/cytoscape.esm-BHYC38rz.jsView on unpkg

dist-web/assets/sql-D0XecflT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/sql-D0XecflT.jsView on unpkg

dist-web/assets/vbscript-BuJXcnF6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/vbscript-BuJXcnF6.jsView on unpkg

Lines 1356-1396javascript

1356 if (data === null) return false;

1357 try {

1358 var source = "(" + data + ")", ast = esprima.parse(source, { range: true });

1359 if (ast.type !== "Program" || ast.body.length !== 1 || ast.body[0].type !== "ExpressionStatement" || ast.body[0].expression.type !== "ArrowFunctionExpression" && ast.body[0

1360 return false;

1361 }

1362 return true;

1363 } catch (err) {

1364 return false;

1365 }

1366 }

1367 function constructJavascriptFunction(data) {

1368 var source = "(" + data + ")", ast = esprima.parse(source, { range: true }), params = [], body;

1369 if (ast.type !== "Program" || ast.body.length !== 1 || ast.body[0].type !== "ExpressionStatement" || ast.body[0].expression.type !== "ArrowFunctionExpression" && ast.body[0

1370 throw new Error("Failed to resolve function");

1371 }

1372 ast.body[0].expression.params.forEach(function(param) {

1373 params.push(param.name);

1374 });

1375 body = ast.body[0].expression.body.range;

1376 if (ast.body[0].expression.body.type === "BlockStatement") {

1377 return new Function(params, source.slice(body[0] + 1, body[1] - 1));

1378 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjsView on unpkg · L1376

1379 return new Function(params, "return " + source.slice(body[0], body[1]));

1380 }

1381 function representJavascriptFunction(object) {

1382 return object.toString();

1383 }

1384 function isFunction(object) {

1385 return Object.prototype.toString.call(object) === "[object Function]";

1386 }

1387 module2.exports = new Type("tag:yaml.org,2002:js/function", {

1388 kind: "scalar",

1389 resolve: resolveJavascriptFunction,

1390 construct: constructJavascriptFunction,

1391 predicate: isFunction,

1392 represent: representJavascriptFunction

1393 });

1394 }

1395});

1396