tianshu-tui@2.19.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tianshu-tui@2.19.4: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/chunk-2H272X3B.js` starts an `osascript` JXA host that decodes base64 requests and calls `eval(code)` at runtime.
`dist/chunk-P75EQYQQ.js` discovers `~/.rivet/plugins` and dynamically imports plugin entry modules.
`dist/chunk-RVUCSJMJ.js` persists an app allow-grant only after an approved `computer_use` request with `remember === true`.
`package.json` has a `postinstall` command that attempts `patch-package` and a git-hook installer.

Evidence against

The referenced `scripts/install-git-hooks.mjs` is absent from the published package, so the install-time hook attempt fails and falls through to `node -e 1`.
No inspected lifecycle code writes foreign AI-agent configuration, credentials, or broad control surfaces.
The JXA evaluator is part of named computer-use functionality and its host is gated by `hostEnabled()`.
Observed network code is package-aligned OAuth/search functionality; no source evidence showed credential harvesting or covert exfiltration.
`dist/chunk-IQQLDJDH.js` uses fixed-argument `execFile` calls for Git status, not shell-string execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 7.01 MB of source, external domains: 127.0.0.1, angular.io, api.anthropic.com, api.deepseek.com, api.github.com, api.kimi.com, api.linear.app, api.longcat.chat, api.minimaxi.com, api.notion.com, api.openai.com, api.search.brave.com, api.siliconflow.cn, api.tavily.com, api.xiaomimimo.com, astral.sh, auth.openai.com, chatgpt.com, dom.spec.whatwg.org, fetch.spec.whatwg.org, git-scm.com, gitcode.com, github.com, goproxy.cn, html.duckduckgo.com, hub.fastgit.xyz, json-schema.org, kkgithub.com, linear.app, lists.w3.org, mimesniff.spec.whatwg.org, mirrors.aliyun.com, mirrors.cloud.tencent.com, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, open.bigmodel.cn, platform.deepseek.com, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, repo.huaweicloud.com, slack.com, spec.openapis.org, stackoverflow.com, token-plan-cn.xiaomimimo.com, token-plan-sgp.xiaomimimo.com, tools.ietf.org, trac.webkit.org, url.spec.whatwg.org

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || node -e 1 && node scripts/install-git-hooks.mjs || node -e 1

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = patch-package || node -e 1 && node scripts/install-git-hooks.mjs || node -e 1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/manager-2G7YLWRW.jsView file

7475init_esm_shims(); L7476: var cp = __require("child_process"); L7477: var parse2 = require_parse();

High

Child Process

Package source references child process execution.

dist/manager-2G7YLWRW.jsView on unpkg · L7475

7391parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`]; L7392: parsed.command = process.env.comspec || "cmd.exe"; L7393: parsed.options.windowsVerbatimArguments = true;

High

Shell

Package source references shell execution.

dist/manager-2G7YLWRW.jsView on unpkg · L7391

1258Cross-file remote execution chain: dist/manager-2G7YLWRW.js spawns dist/chunk-IJBFTQ6N.js; helper contains network access plus dynamic code execution. L1258: // validation function arguments L1259: data: new codegen_1.Name("data"), L1260: // data passed to validation function ... L2297: id = normalizeId(id); L2298: return resolver.resolve(baseId, id); L2299: } ... L3165: for (i = 0; i < input.length; i++) { L3166: code = input[i].charCodeAt(0); L3167: if (code === 48) { ... L6993: function checkPathExt(path, options) { L6994: var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT; L6995: if (!pathext) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/manager-2G7YLWRW.jsView on unpkg · L1258

dist/chunk-2H272X3B.jsView file

66listSkillFiles, L67: rewritePowershellNullRedirect, L68: rewriteWindowsNullRedirect, ... L125: L126: // node_modules/undici/lib/core/symbols.js L127: var require_symbols = __commonJS({ ... L152: kBodyUsed: /* @__PURE__ */ Symbol("used"), L153: kBody: /* @__PURE__ */ Symbol("abstracted request body"), L154: kRunning: /* @__PURE__ */ Symbol("running"), ... L269: * @type {-2|-1|0|1} L270: * @private L271: */

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-2H272X3B.jsView on unpkg · L66

5666var EnvironmentSettingsObjectBase = class { L5667: get baseUrl() { L5668: return getGlobalOrigin(); ... L26271: import { createRequire } from "module"; L26272: import { spawn } from "child_process"; L26273: var _esbuildPromise; ... L31554: mkdirSync2(dirname5(path), { recursive: true }); L31555: writeFileSync(path, JSON.stringify(file, null, 2), "utf-8"); L31556: }

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-2H272X3B.jsView on unpkg · L5666

29313const code = ObjC.unwrap($.NSString.alloc.initWithDataEncoding(codeData, $.NSUTF8StringEncoding)); L29314: const out = (function () { return eval(code); })(); L29315: __reply({ id: req.id, ok: true, out: (out === undefined || out === null) ? '' : String(out) });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-2H272X3B.jsView on unpkg · L29313

dist/chunk-NPUWTHOG.jsView file

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096 L2: import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-NPUWTHOG.jsView on unpkg · L1

dist/chunk-HDSVQICG.jsView file

245try { L246: const obj = JSON.parse(json); L247: if (!obj || typeof obj !== "object") return null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-HDSVQICG.jsView on unpkg · L245

dist/chunk-DNWXZELS.jsView file

14init_esm_shims(); L15: import { execFile } from "child_process"; L16: import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "fs"; ... L51: label: "system service / daemon control (a background process or service state changed)", L52: test: /\b(systemctl|service)\s+(start|stop|restart|enable|disable|reload)\b|\blaunchctl\s+(load|unload|bootstrap|bootout)\b|\bpm2\s+(start|stop|restart|delete)\b|\b(brew\s+services... L53: } ... L94: try { L95: return JSON.parse(readFileSync(file, "utf-8")); L96: } catch { ... L137: async function gitLines(cwd, args) { L138: const { stdout } = await execFileP("git", ["-c", "core.quotePath=false", ...args], { cwd, timeout: 5e3, encoding: "utf-8" }); L139: return stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-DNWXZELS.jsView on unpkg · L14

dist/chunk-PEBVC24M.jsView file

26607} L26608: return new Promise((resolve4) => { L26609: const child = spawn(command, { L26610: shell: true, ... L26614: let lastErr = ""; L26615: const stdoutDecoder = new WinStreamDecoder(); L26616: const stderrDecoder = new WinStreamDecoder(); L26617: child.stdout?.on("data", (data) => { L26618: emitLines(stdoutDecoder.write(data), onLine); L26619: lastErr = "";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-PEBVC24M.jsView on unpkg · L26607

dist/chunk-X7K64DWV.jsView file

111"*.map", L112: "package-lock.json", L113: "yarn.lock", ... L184: init_esm_shims(); L185: function applyCommandFilter(command, stdout, exitCode) { L186: const cmd = command.trim(); ... L616: try { L617: const parsed = JSON.parse(content); L618: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1189: init_esm_shims(); L1190: import { execFile } from "child_process"; L1191: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-X7K64DWV.jsView on unpkg · L111

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

dist/chunk-ODMCNB2T.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tianshu-tui@2.17.1 matchedIdentity = npm:dGlhbnNodS10dWk:2.17.1 similarity = 0.569 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-ODMCNB2T.jsView on unpkg