tensorlake@0.5.132: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tensorlake@0.5.132: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

6649init_esm_shims(); L6650: import { execFile } from "child_process"; L6651: import { accessSync, constants } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6649

383// The bundled worker needs no application loaders or telemetry preloads. L384: // NODE_OPTIONS is parsed independently of execArgv by Node. L385: execArgv: [],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L383

bin/tensorlake-deploy.cjsView file

2L3: const { runPythonModule } = require("../lib/runtime.cjs"); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tensorlake-deploy.cjsView on unpkg · L2

dist/applications/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = tensorlake@0.5.131 matchedIdentity = npm:dGVuc29ybGFrZQ:0.5.131 similarity = 0.448 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/applications/index.cjsView on unpkg

52Cross-file remote execution chain: dist/applications/index.cjs spawns dist/function-agent/main.js; helper contains network access plus dynamic code execution. L52: SDK_VERSION = "0.5.132"; L53: API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai"; L54: API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0; ... L144: try { L145: const payload = JSON.parse(message); L146: if (payload && typeof payload === "object" && !Array.isArray(payload)) { ... L347: if (handle) this.register(handle, worker); L348: this.send(worker, { L349: type: "call", ... L374: // The bundled worker needs no application loaders or telemetry preloads. L375: // NODE_OPTIONS is parsed independently of execArgv by Node. L376: execArgv: [],

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/applications/index.cjsView on unpkg · L52

package.jsonView file

46"scripts": { "build:sdk": "tsup", "build:runtime": "node ./scripts/build-function-executor-capsule.mjs && node ./scripts/build-typescript-function-runner-capsule.mjs && node ./scripts/check-package-compatibility.mjs", "build:native": "node ./scripts/build-native.mjs", "build": "npm run build:sdk && npm run build:native && npm run build:runtime", "check:proto": "node ./scripts/check-function-executor-proto.mjs", "typecheck": "tsc --noEmit", "test": "vitest run --exclude tests/integration.test.ts", "test:function-executor": "vitest run tests/function-executor

Medium

Suspicious Lifecycle Evidence

The manifest exposes SDK and CLI entrypoints but contains no install lifecycle hook.

package.jsonView on unpkg · L46

Source & flagged code

6 flagged

dist/index.jsView file

Lines 363-403javascript

363 stream: !!emit

364 });

365 } catch (error) {

366 this.pending.delete(id);

367 this.unrefIfIdle();

368 reject(error);

369 }

370 });

371 promise[cancelNativeCall] = () => {

372 const pending = this.pending.get(id);

373 if (pending && worker) {

374 pending.emit = void 0;

375 this.send(worker, { type: "cancel", id });

376 }

377 };

378 return promise;

379 }

380 getWorker() {

381 if (this.worker) return this.worker;

382 const worker = new Worker(this.workerPath(), {

383 // The bundled worker needs no application loaders or telemetry preloads.

384 // NODE_OPTIONS is parsed independently of execArgv by Node.

385 execArgv: [],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L383

386 env: { ...process.env, NODE_OPTIONS: "" },

387 name: "tensorlake-native"

388 });

389 this.worker = worker;

390 worker.on("message", (message) => {

391 const pending = this.pending.get(message.id);

392 if (!pending || this.worker !== worker) return;

393 if (message.type === "event") {

394 Promise.resolve().then(() => pending.emit?.(message.value)).then(

395 () => {

396 if (this.worker === worker)

397 this.send(worker, { type: "ack", id: message.id });

398 },

399 (error) => {

400 this.send(worker, { type: "cancel", id: message.id });

401 pending.reject(error);

402 }

403 );

Lines 6629-6669javascript

6629});

6630

6631// src/index.ts

6632init_esm_shims();

6633init_client();

6634init_sandbox();

6635init_sandbox();

6636init_desktop();

6637init_tunnel();

6638init_cloud_client();

6639

bin/tensorlake-deploy.cjsView file

Lines 1-9javascript

1#!/usr/bin/env node

2

3const { runPythonModule } = require("../lib/runtime.cjs");

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tensorlake-deploy.cjsView on unpkg · L2

5runPythonModule(

6 "tensorlake.cli.deploy"

dist/applications/index.cjsView file

Lines 32-72javascript

32 mod

33));

34var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

35

36// node_modules/tsup/assets/cjs_shims.js

package.jsonView file

Lines 26-66json

26 }

27 },

28 "./applications": {

29 "import": {

30 "types": "./dist/applications/index.d.ts",

31 "default": "./dist/applications/index.js"

32 },

33