tianshu-tui@2.17.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

tianshu-tui@2.17.1: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json defines postinstall, but it is `patch-package || node -e 1` only.
dist/chunk-4PD6T2WM.js includes powerful user-invoked agent tools: shell, file export/import, browser/computer-use eval.
dist/chunk-EW5QGLUQ.js can mutate Rivet MCP config via explicit `rivet config mcp ...` commands.

Evidence against

No `patches/**` files are shipped, so postinstall has no bundled patch payload to apply.
dist/main.js is a CLI entrypoint importing bundled Rivet/TUI modules, with no import-time exfiltration found.
dist/chunk-2OLE4JZS.js stores OAuth tokens under Rivet auth state and contacts OpenAI auth endpoints for declared login flow.
Network endpoints are model/provider APIs configured for the terminal AI agent, not hardcoded drop sites.
Dynamic eval in dist/chunk-4PD6T2WM.js is part of approved computer-use/JXA/browser tooling, not hidden install-time code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 102 file(s), 4.62 MB of source, external domains: 127.0.0.1, angular.io, api.anthropic.com, api.deepseek.com, api.kimi.com, api.minimaxi.com, api.siliconflow.cn, api.xiaomimimo.com, astral.sh, auth.openai.com, chatgpt.com, dom.spec.whatwg.org, git-scm.com, gitcode.com, github.com, goproxy.cn, html.duckduckgo.com, hub.fastgit.xyz, jimmy.warting.se, json-schema.org, kkgithub.com, lists.w3.org, mirrors.aliyun.com, mirrors.cloud.tencent.com, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, open.bigmodel.cn, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, registry.npmmirror.com, repo.huaweicloud.com, spec.openapis.org, stackoverflow.com, token-plan-cn.xiaomimimo.com, token-plan-sgp.xiaomimimo.com, tools.ietf.org, trac.webkit.org, url.spec.whatwg.org, www.ibm.com, www.ietf.org, www.libreoffice.org, www.python.org, www.safaribooksonline.com, www.w3.org, www.whatwg.org

Oversized source lightweight scan

dist/chunk-EF3XLWYR.js2.12 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStringsjimmy.warting.sewww.ietf.org

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || node -e 1

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = patch-package || node -e 1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-UUUIMCLB.jsView file

11init_esm_shims(); L12: import { spawnSync } from "child_process"; L13:

High

Child Process

Package source references child process execution.

dist/chunk-UUUIMCLB.jsView on unpkg · L11

dist/chunk-JYIBPUKH.jsView file

420try { L421: const child = spawnHidden(command, [], { cwd, shell: true, stdio: ["ignore", "pipe", "pipe"] }); L422: child.stdout?.on("data", (d) => {

High

Shell

Package source references shell execution.

dist/chunk-JYIBPUKH.jsView on unpkg · L420

dist/chunk-4PD6T2WM.jsView file

60listSkillFiles, L61: rewritePowershellNullRedirect, L62: rewriteWindowsNullRedirect, ... L127: for (let i = 0; i < text.length; i++) { L128: if (text.charCodeAt(i) === 10) { L129: if (i > 0 && text.charCodeAt(i - 1) === 13) crlf++; ... L281: function resolveExcludeDirs() { L282: const env = process.env.RIVET_AST_EXCLUDE; L283: if (!env) return new Set(BASE_EXCLUDE_DIRS); ... L407: for (const p of paths) { L408: const resolved = resolve2(params.cwd ?? process.cwd(), p); L409: try {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-4PD6T2WM.jsView on unpkg · L60

2413const code = ObjC.unwrap($.NSString.alloc.initWithDataEncoding(codeData, $.NSUTF8StringEncoding)); L2414: const out = (function () { return eval(code); })(); L2415: __reply({ id: req.id, ok: true, out: (out === undefined || out === null) ? '' : String(out) });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-4PD6T2WM.jsView on unpkg · L2413

dist/chunk-ROJQUDWP.jsView file

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096 L2: import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ROJQUDWP.jsView on unpkg · L1

dist/chunk-VGM6FTOP.jsView file

245try { L246: const obj = JSON.parse(json); L247: if (!obj || typeof obj !== "object") return null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-VGM6FTOP.jsView on unpkg · L245

dist/chunk-LBADLVH4.jsView file

14init_esm_shims(); L15: import { execFile } from "child_process"; L16: import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "fs"; ... L51: label: "system service / daemon control (a background process or service state changed)", L52: test: /\b(systemctl|service)\s+(start|stop|restart|enable|disable|reload)\b|\blaunchctl\s+(load|unload|bootstrap|bootout)\b|\bpm2\s+(start|stop|restart|delete)\b|\b(brew\s+services... L53: } ... L94: try { L95: return JSON.parse(readFileSync(file, "utf-8")); L96: } catch { ... L137: async function gitLines(cwd, args) { L138: const { stdout } = await execFileP("git", ["-c", "core.quotePath=false", ...args], { cwd, timeout: 5e3, encoding: "utf-8" }); L139: return stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-LBADLVH4.jsView on unpkg · L14

dist/chunk-AGYKYPVW.jsView file

112"*.map", L113: "package-lock.json", L114: "yarn.lock", ... L185: init_esm_shims(); L186: function applyCommandFilter(command, stdout, exitCode) { L187: const cmd = command.trim(); ... L617: try { L618: const parsed = JSON.parse(content); L619: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1190: init_esm_shims(); L1191: import { execFile } from "child_process"; L1192: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-AGYKYPVW.jsView on unpkg · L112

112Cross-file remote execution chain: dist/chunk-AGYKYPVW.js spawns dist/chunk-EW5QGLUQ.js; helper contains network access plus dynamic code execution. L112: "*.map", L113: "package-lock.json", L114: "yarn.lock", ... L185: init_esm_shims(); L186: function applyCommandFilter(command, stdout, exitCode) { L187: const cmd = command.trim(); ... L617: try { L618: const parsed = JSON.parse(content); L619: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1190: init_esm_shims(); L1191: import { execFile } from "child_process"; L1192: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-AGYKYPVW.jsView on unpkg · L112

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

dist/chunk-EF3XLWYR.jsView file

•path = dist/chunk-EF3XLWYR.js kind = oversized_source_file sizeBytes = 2227937 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-EF3XLWYR.jsView on unpkg

•path = dist/chunk-EF3XLWYR.js kind = oversized_cli_entrypoint sizeBytes = 2227937 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/chunk-EF3XLWYR.jsView on unpkg

dist/chunk-2OLE4JZS.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tianshu-tui@2.15.0 matchedIdentity = npm:dGlhbnNodS10dWk:2.15.0 similarity = 0.615 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-2OLE4JZS.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 18-58json

18 "url": "git+https://github.com/huiliyi37/Tianshu-Tui.git"

19 },

20 "bugs": {

21 "url": "https://github.com/huiliyi37/Tianshu-Tui/issues"

22 },

23 "engines": {

24 "node": ">=24"

25 },

26 "files": [

27 "dist/",

28 "!dist/node_modules",

29 "!dist/native",

30 "README.md",

31 "LICENSE",

32 "completions/"

33 ],

34 "bin": {

35 "rivet": "dist/main.js"

36 },

37 "scripts": {

38 "postinstall": "patch-package || node -e 1",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L38

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "prepublishOnly": "npm run build",

40 "dev": "tsup --watch",

41 "build": "tsup",

42 "start": "node --expose-gc --max-old-space-size=4096 dist/main.js",

43 "typecheck": "tsc --noEmit",

44 "typecheck:baseline": "tsx scripts/typecheck-baseline.ts",

45 "test": "tsx scripts/run-node-tests.ts",

46 "test:unit": "tsx scripts/run-node-tests.ts --unit",

47 "test:integration": "tsx scripts/run-node-tests.ts --integration",

48 "test:fast": "tsx scripts/run-node-tests.ts --exclude-tui",

49 "test:desktop": "node --import ./desktop/scripts/test-alias-register.mjs --import tsx --test-force-exit --test 'desktop/src/**/__tests__/*.test.ts'",

50 "test:incremental": "tsx scripts/test-incremental.ts",

51 "cache:audit": "tsx src/cache/cache-audit-cli.ts",

52 "tokens:audit": "tsx scripts/analyze-output-tokens.ts",

53 "benchmark": "tsx scripts/run-benchmark.ts"

54 },

55 "dependencies": {

56 "@ast-grep/lang-json": "^0.0.7",

57 "@ast-grep/lang-python": "^0.0.6",

58 "@ast-grep/napi": "^0.44.0",

dist/chunk-UUUIMCLB.jsView file

Lines 1-31javascript

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096

2import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);

3import {

4 getEffectiveVerifications

dist/chunk-JYIBPUKH.jsView file

Lines 400-440javascript

400 if (hit && hit.sig === sig) return hit.outcome;

401 }

402 const outcome = await runChangedFilesTypecheckOutcome(cwd, changedFiles, run, baseline);

403 if (sig

dist/chunk-4PD6T2WM.jsView file

Lines 2393-2433javascript

2393const __stdin = $.NSFileHandle.fileHandleWithStandardInput;

2394const __stdout = $.NSFileHandle.fileHandleWithStandardOutput;

2395function __reply(obj) {

2396 const line

dist/chunk-ROJQUDWP.jsView file

Lines 1-21javascript

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096

2import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);

3import {

Medium

dist/chunk-VGM6FTOP.jsView file

Lines 225-265javascript

225 if (!graphValidation.valid) {

226 for (const d of graphValidation.dangling) {

227 errors.push(`dangling dep: ${d.taskId} \u2192 ${d

dist/chunk-LBADLVH4.jsView file

Lines 1-34javascript

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096

2import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);

3import {

4 rivetHome

dist/chunk-AGYKYPVW.jsView file

112"*.map", L113: "package-lock.json", L114: "yarn.lock", ... L185: init_esm_shims(); L186: function applyCommandFilter(command, stdout, exitCode) { L187: const cmd = command.trim(); ... L617: try { L618: const parsed = JSON.parse(content); L619: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1190: init_esm_shims(); L1191: import { execFile } from "child_process"; L1192: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-AGYKYPVW.jsView on unpkg · L112

112Cross-file remote execution chain: dist/chunk-AGYKYPVW.js spawns dist/chunk-EW5QGLUQ.js; helper contains network access plus dynamic code execution. L112: "*.map", L113: "package-lock.json", L114: "yarn.lock", ... L185: init_esm_shims(); L186: function applyCommandFilter(command, stdout, exitCode) { L187: const cmd = command.trim(); ... L617: try { L618: const parsed = JSON.parse(content); L619: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1190: init_esm_shims(); L1191: import { execFile } from "child_process"; L1192: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-AGYKYPVW.jsView on unpkg · L112

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

dist/chunk-EF3XLWYR.jsView file

•path = dist/chunk-EF3XLWYR.js kind = oversized_source_file sizeBytes = 2227937 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-EF3XLWYR.jsView on unpkg

•path = dist/chunk-EF3XLWYR.js kind = oversized_cli_entrypoint sizeBytes = 2227937 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/chunk-EF3XLWYR.jsView on unpkg

dist/chunk-2OLE4JZS.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tianshu-tui@2.15.0 matchedIdentity = npm:dGlhbnNodS10dWk:2.15.0 similarity = 0.615 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-2OLE4JZS.jsView on unpkg