talking-stick@0.13.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

talking-stick@0.13.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/process-utils.jsView file

1import { execFileSync } from "node:child_process"; L2: export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

dist/instructions.jsView file

316stdio: "inherit", L317: shell: true L318: });

High

Shell

Package source references shell execution.

dist/instructions.jsView on unpkg · L316

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/instructions.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/instructions.jsView on unpkg

scripts/skiller-bootstrap.cjsView file

1#!/usr/bin/env node L2: const childProcess = require("node:child_process"); L3: const crypto = require("node:crypto"); L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); ... L8: L9: const SKILLER_VERSION = process.env.TALKING_STICK_SKILLER_VERSION || "v0.1.0"; L10: const SKILLER_MIN_VERSION = process.env.TALKING_STICK_SKILLER_MIN_VERSION || "0.1.0";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/skiller-bootstrap.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = scripts/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/skiller-bootstrap.cjsView on unpkg

dist/cli/guardian.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/cli/guardian.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/guardian.jsView on unpkg

dist/install.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/install.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.jsView on unpkg

dist/skiller-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skiller-adapter.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.13.0",

4 "description": "CLI coordination tool for path-scoped agent handoffs.",

5 "type": "module",

6 "bin": {

7 "tt": "dist/cli.js"

8 },

9 "exports": {

10 ".": "./dist/index.js"

11 },

12 "files": [

13 "CHANGELOG.md",

14 "dist",

15 "LICENSE.md",

16 "scripts",

17 "skills",

18 "docs",

19 "README.md"

20 ],

21 "scripts": {

22 "build": "node scripts/clean-dist.cjs && tsc -p tsconfig.build.json && chmod +x dist/cli.js",

23 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "prepare": "node scripts/clean-dist.cjs && tsc -p tsconfig.build.json && chmod +x dist/cli.js",

25 "test": "vitest run",

26 "version": "node scripts/prepare-release.mjs --from-package",

27 "typecheck": "tsc -p tsconfig.json --noEmit"

28 },

29 "dependencies": {

30 "better-sqlite3": "^12.9.0",

31 "zod": "^3.25.76"

32 },

33 "devDependencies": {

34 "@types/better-sqlite3": "^7.6.13",

35 "@types/node": "^25.6.0",

36 "tsx": "^4.21.0",

37 "typescript": "^6.0.3",

38 "vitest": "^4.1.5"

39 },

40 "engines": {

41 "node": ">=22"

42 },

43 "license": "MIT"

dist/process-utils.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

3 if (processRef.pid ===

dist/instructions.jsView file

Lines 296-336javascript

296 const env = options.env ?? process.env;

297 const explicit = env.VISUAL?.trim() || env.EDITOR?.trim();

scripts/skiller-bootstrap.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const childProcess = require("node:child_process");

3const crypto = require("node:crypto");

4const fs

dist/cli/guardian.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/cli/guardian.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/guardian.jsView on unpkg

dist/install.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/install.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.jsView on unpkg

dist/skiller-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.12.0 matchedPath = dist/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skiller-adapter.jsView on unpkg