tianshu-tui@2.11.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

tianshu-tui@2.11.0: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json has postinstall lifecycle: patch-package || node -e 1
dist/chunk-ML26H62L.js exposes agent tools for file edits, apply_patch, shell/git/LSP under runtime approval flow
dist/chunk-RC3EOXPM.js defines remote AI provider endpoints and API-key env vars

Evidence against

No patches/patches directory found, so postinstall falls back harmlessly when patch-package is unavailable
package.json bin rivet points to dist/main.js; no install-time import of main CLI code
Tool execution in dist/chunk-XQQS4WXF.js checks approvalMode, deny/allow rules, path grants, and write approval before mutating actions
Network endpoints are package-aligned AI/auth/update providers for a terminal coding agent
API keys are resolved from config/env for provider calls; no source evidence of credential harvesting or off-purpose exfiltration
Dynamic require/import and new Function hits are bundled dependencies or lazy loading patterns

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 7.19 MB of source, external domains: angular.io, api.anthropic.com, api.deepseek.com, api.github.com, api.kimi.com, api.minimaxi.com, api.openai.com, api.siliconflow.cn, api.xiaomimimo.com, astral.sh, auth.openai.com, chatgpt.com, dom.spec.whatwg.org, fetch.spec.whatwg.org, git-scm.com, gitcode.com, github.com, goproxy.cn, html.duckduckgo.com, hub.fastgit.xyz, json-schema.org, kkgithub.com, lists.w3.org, mimesniff.spec.whatwg.org, mirrors.aliyun.com, mirrors.cloud.tencent.com, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, open.bigmodel.cn, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, repo.huaweicloud.com, spec.openapis.org, stackoverflow.com, token-plan-cn.xiaomimimo.com, token-plan-sgp.xiaomimimo.com, tools.ietf.org, trac.webkit.org, url.spec.whatwg.org, webidl.spec.whatwg.org, www.ibm.com, www.ietf.org, www.python.org, www.safaribooksonline.com, www.w3.org, www.whatwg.org

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || node -e 1

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = patch-package || node -e 1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-4J2XMKJE.jsView file

445init_esm_shims(); L446: import { spawnSync } from "child_process"; L447: var isWin = process.platform === "win32";

High

Child Process

Package source references child process execution.

dist/chunk-4J2XMKJE.jsView on unpkg · L445

2272// zsh sysopen L2273: /\bpowershell\s+-enc/i, L2274: // PowerShell encoded execution

High

Shell

Package source references shell execution.

dist/chunk-4J2XMKJE.jsView on unpkg · L2272

99try { L100: saved = JSON.parse(readFileSync(file, "utf-8")); L101: } catch { ... L445: init_esm_shims(); L446: import { spawnSync } from "child_process"; L447: var isWin = process.platform === "win32"; L448: function killProcessTree(child, signal, kill = process.kill) { ... L572: "*.map", L573: "package-lock.json", L574: "yarn.lock", ... L645: init_esm_shims(); L646: function applyCommandFilter(command, stdout, exitCode) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-4J2XMKJE.jsView on unpkg · L99

dist/chunk-TTEFJPVG.jsView file

2985sourceCode = this.opts.code.process(sourceCode, sch); L2986: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2987: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TTEFJPVG.jsView on unpkg · L2985

dist/chunk-XQQS4WXF.jsView file

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=1536 L2: import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-XQQS4WXF.jsView on unpkg · L1

dist/chunk-ML26H62L.jsView file

5749var EnvironmentSettingsObjectBase = class { L5750: get baseUrl() { L5751: return getGlobalOrigin(); ... L27103: mkdirSync(dir, { recursive: true }); L27104: writeFileSync(join2(dir, SENTINEL_FILE), JSON.stringify(value, null, 2) + "\n", "utf-8"); L27105: } ... L27843: import { existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3, r... L27844: import { spawnSync as spawnSync3 } from "child_process"; L27845: ... L38485: /doctor \u2014 Environment health check (Node/Git/Python/uv) + which shell the bash tool uses L38486: /tools \u2014 Show available tools and their descriptions L38487: /compact \u2014 Compact context (summarize old messages)

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-ML26H62L.jsView on unpkg · L5749

dist/chunk-JZQX4WBT.jsView file

54Cross-file remote execution chain: dist/chunk-JZQX4WBT.js spawns dist/turndown.es-3POKCBCW.js; helper contains network access plus dynamic code execution. L54: listSkillFiles, L55: rewritePowershellNullRedirect, L56: rewriteWindowsNullRedirect, ... L95: for (let i = 0; i < text.length; i++) { L96: if (text.charCodeAt(i) === 10) { L97: if (i > 0 && text.charCodeAt(i - 1) === 13) crlf++; ... L205: function resolveExcludeDirs() { L206: const env = process.env.RIVET_AST_EXCLUDE; L207: if (!env) return new Set(BASE_EXCLUDE_DIRS); ... L323: for (const p of paths) { L324: const resolved = resolve2(params.cwd ?? process.cwd(), p); L325: allFiles.push(...collectFiles(resolved));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-JZQX4WBT.jsView on unpkg · L54

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 18-58json

18 "url": "git+https://github.com/huiliyi37/Tianshu-Tui.git"

19 },

20 "bugs": {

21 "url": "https://github.com/huiliyi37/Tianshu-Tui/issues"

22 },

23 "engines": {

24 "node": "24.1.0"

25 },

26 "files": [

27 "dist/",

28 "!dist/node_modules",

29 "!dist/native",

30 "README.md",

31 "LICENSE",

32 "completions/"

33 ],

34 "bin": {

35 "rivet": "./dist/main.js"

36 },

37 "scripts": {

38 "postinstall": "patch-package || node -e 1",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L38

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "prepublishOnly": "npm run build",

40 "dev": "tsup --watch",

41 "build": "tsup",

42 "start": "node --expose-gc --max-old-space-size=1536 dist/main.js",

43 "typecheck": "tsc --noEmit",

44 "typecheck:baseline": "tsx scripts/typecheck-baseline.ts",

45 "test": "tsx scripts/run-node-tests.ts",

46 "test:unit": "tsx scripts/run-node-tests.ts --unit",

47 "test:integration": "tsx scripts/run-node-tests.ts --integration",

48 "test:fast": "tsx scripts/run-node-tests.ts --exclude-tui",

49 "test:desktop": "node --import ./desktop/scripts/test-alias-register.mjs --import tsx --test-force-exit --test 'desktop/src/**/__tests__/*.test.ts'",

50 "test:incremental": "tsx scripts/test-incremental.ts",

51 "cache:audit": "tsx src/cache/cache-audit-cli.ts",

52 "tokens:audit": "tsx scripts/analyze-output-tokens.ts",

53 "benchmark": "tsx scripts/run-benchmark.ts"

54 },

55 "dependencies": {

56 "@ast-grep/lang-json": "^0.0.7",

57 "@ast-grep/lang-python": "^0.0.6",

58 "@ast-grep/napi": "^0.44.0",

dist/chunk-4J2XMKJE.jsView file

Lines 79-119javascript

79}

80function isWriteGranted(absPath) {

81 const target = canonicalize(absPath);

82 return _grants.some((g) => g.mode

dist/chunk-TTEFJPVG.jsView file

Lines 2965-3005javascript

2965 validateName,

2966 ValidationError: _ValidationError,

2967 schema: sch.schema,

2968 schemaEnv: sch,

2969 rootId,

2970 baseId: sch.baseId || rootId,

2971 schemaPath

dist/chunk-XQQS4WXF.jsView file

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=1536 L2: import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-XQQS4WXF.jsView on unpkg · L1

dist/chunk-ML26H62L.jsView file

5749var EnvironmentSettingsObjectBase = class { L5750: get baseUrl() { L5751: return getGlobalOrigin(); ... L27103: mkdirSync(dir, { recursive: true }); L27104: writeFileSync(join2(dir, SENTINEL_FILE), JSON.stringify(value, null, 2) + "\n", "utf-8"); L27105: } ... L27843: import { existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3, r... L27844: import { spawnSync as spawnSync3 } from "child_process"; L27845: ... L38485: /doctor \u2014 Environment health check (Node/Git/Python/uv) + which shell the bash tool uses L38486: /tools \u2014 Show available tools and their descriptions L38487: /compact \u2014 Compact context (summarize old messages)

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-ML26H62L.jsView on unpkg · L5749

dist/chunk-JZQX4WBT.jsView file

54Cross-file remote execution chain: dist/chunk-JZQX4WBT.js spawns dist/turndown.es-3POKCBCW.js; helper contains network access plus dynamic code execution. L54: listSkillFiles, L55: rewritePowershellNullRedirect, L56: rewriteWindowsNullRedirect, ... L95: for (let i = 0; i < text.length; i++) { L96: if (text.charCodeAt(i) === 10) { L97: if (i > 0 && text.charCodeAt(i - 1) === 13) crlf++; ... L205: function resolveExcludeDirs() { L206: const env = process.env.RIVET_AST_EXCLUDE; L207: if (!env) return new Set(BASE_EXCLUDE_DIRS); ... L323: for (const p of paths) { L324: const resolved = resolve2(params.cwd ?? process.cwd(), p); L325: allFiles.push(...collectFiles(resolved));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-JZQX4WBT.jsView on unpkg · L54

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg