tandem-editor: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tandem-editor: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/cli/index.jsView file

76// src/server/integrations/acl-win.ts L77: import { execFile } from "child_process"; L78: import { join } from "path";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L76

82} L83: async function runPowerShell(script, env) { L84: const args2 = ["-NoProfile", "-NonInteractive", "-Command", script];

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L82

4326); L4327: console.error("[Tandem] See https://github.com/bloknayrb/tandem/issues/477 for context."); L4328: console.error("[Tandem] Starting server..."); L4329: const proc = spawn("node", [SERVER_DIST], { L4330: stdio: "inherit", L4331: env: process.env L4332: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L4326

20Cross-file remote execution chain: dist/cli/index.js spawns dist/monitor/index.js; helper contains network access plus dynamic code execution. L20: import { fileURLToPath } from "url"; L21: var __dirname, SKILL_PATH, SKILL_CONTENT; L22: var init_skill_content = __esm({ ... L37: DEFAULT_MCP_PORT = 3479; L38: TANDEM_REPO_URL = "https://github.com/bloknayrb/tandem"; L39: TANDEM_ISSUES_NEW_URL = `${TANDEM_REPO_URL}/issues/new`; ... L61: function resolveAppDataDir() { L62: const envOverride = process.env.TANDEM_APP_DATA_DIR; L63: if (envOverride && envOverride.length > 0) return envOverride; ... L76: // src/server/integrations/acl-win.ts L77: import { execFile } from "child_process"; L78: import { join } from "path";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L20

dist/channel/index.jsView file

2946sourceCode = this.opts.code.process(sourceCode, sch); L2947: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2948: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/channel/index.jsView on unpkg · L2946

dist/client/assets/index-BymYYAwj.jsView file

214contains invisible/control Unicode U+200D (zero width joiner) `,Pq=`️`,Fq=`<U+200D>`,Iq=``,Lq=null,Rq=null;function zq(e=[]){let t={};xK.groups=t;let n=new xK;Lq??=Uq(oK),Rq??=Uq(sK),$(n,`'`,eq),$(n,`{`,LK),$(n,`}`,RK),$(n,`[`,zK),$(n,`]`,BK),$(n,`(`,VK),$(n,`)`,HK),$(n,`<`,UK),$(n,`>`,WK),$(n,`（`,GK

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/index-BymYYAwj.jsView on unpkg · L214

dist/client/fonts/inter-tight-latin.woff2View file

•path = dist/client/fonts/inter-tight-latin.woff2 kind = high_entropy_blob sizeBytes = 44872 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/fonts/inter-tight-latin.woff2View on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 7082607 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg

Source & flagged code

8 flagged

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

16

17// src/cli/skill-content.ts

18import { readFileSync } from "fs";

19import { dirname, resolve } from "path";

20import { fileURLToPath } from "url";

21var __dirname, SKILL_PATH, SKILL_CONTENT;

22var init_skill_content = __esm({

23 "src/cli/skill-content.ts"() {

24 "use strict";

25 __dirname = dirname(fileURLToPath(import.meta.url));

26 SKILL_PATH = resolve(__dirname, "../../skills/tandem/SKILL.md");

27 SKILL_CONTENT = readFileSync(SKILL_PATH, "utf-8");

28 }

29});

30

31// src/shared/constants.ts

32var DEFAULT_WS_PORT, DEFAULT_MCP_PORT, TANDEM_REPO_URL, TANDEM_ISSUES_NEW_URL, MAX_FILE_SIZE, SESSION_MAX_AGE, TANDEM_MODE_DEFAULT, ACTIVITY_INFO_TTL_MS, CHANNEL_MAX_RETRIES, CHANNEL_RETRY_DELAY_MS, CHANNEL_CONNECT_FETCH_TIMEOUT_MS, CHANNEL_SSE_INACTIVITY_TIMEOUT_MS, CHANNEL_MODE_FETCH_TIMEOUT_MS, CHANNEL_AWARENESS_FETCH_TIMEOUT_MS, CHANNEL_ERROR_REPORT_TIMEOUT_MS, CHANNEL_REPLY_FETCH_TIMEOUT_MS

33var init_constants = __esm({

34 "src/shared/constants.ts"() {

35 "use strict";

36 DEFAULT_WS_PORT = 3478;

37 DEFAULT_MCP_PORT = 3479;

38 TANDEM_REPO_URL = "https://github.com/bloknayrb/tandem";

39 TANDEM_ISSUES_NEW_URL = `${TANDEM_REPO_URL}/issues/new`;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L20

40 MAX_FILE_SIZE = 50 * 1024 * 1024;

Lines 56-102javascript

56});

57

58// src/server/platform.ts

59import envPaths from "env-paths";

60import path from "path";

61function resolveAppDataDir() {

62 const envOverride =

Lines 4306-4346javascript

4306 }

4307});

4308

4309// src/cli/start.ts

4310var start_exports = {};

4311__export(start_exports, {

4312 runStart: () => runStart

4313});

4314import { spawn } from "child_process"

dist/channel/index.jsView file

2946sourceCode = this.opts.code.process(sourceCode, sch); L2947: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2948: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/channel/index.jsView on unpkg · L2946

dist/client/assets/index-BymYYAwj.jsView file

214contains invisible/control Unicode U+200D (zero width joiner) `,Pq=`️`,Fq=`<U+200D>`,Iq=``,Lq=null,Rq=null;function zq(e=[]){let t={};xK.groups=t;let n=new xK;Lq??=Uq(oK),Rq??=Uq(sK),$(n,`'`,eq),$(n,`{`,LK),$(n,`}`,RK),$(n,`[`,zK),$(n,`]`,BK),$(n,`(`,VK),$(n,`)`,HK),$(n,`<`,UK),$(n,`>`,WK),$(n,`（`,GK

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/index-BymYYAwj.jsView on unpkg · L214

dist/client/fonts/inter-tight-latin.woff2View file

•path = dist/client/fonts/inter-tight-latin.woff2 kind = high_entropy_blob sizeBytes = 44872 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/fonts/inter-tight-latin.woff2View on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 7082607 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg