tianshu-tui@2.19.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tianshu-tui@2.19.7: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/chunk-MU4IFTDZ.js` runs generated JXA through `osascript` for macOS GUI automation.
`dist/chunk-MU4IFTDZ.js` exposes browser/desktop control, including page JavaScript evaluation.
`dist/chunk-5DZPHA5B.js` can copy selected skills from `.claude/skills` into `.rivet/skills`.
`package.json` has a `postinstall` hook, though its referenced script is not packaged.

Evidence against

The packaged `postinstall` reference `scripts/install-git-hooks.mjs` is absent and failures are swallowed; no install-time mutation source exists.
`dist/chunk-KZWA4JOC.js` invokes the Claude-skill copy only after explicit `/skill install` or `/skill import`.
`dist/chunk-MU4IFTDZ.js` marks computer-use actions as requiring approval.
`dist/main.js` network activity is an optional version check; no hard-coded exfiltration endpoint was found.
No source establishes credential harvesting, covert persistence, remote payload loading, or foreign agent-control mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 122 file(s), 7.25 MB of source, external domains: 127.0.0.1, angular.io, api.anthropic.com, api.deepseek.com, api.github.com, api.kimi.com, api.linear.app, api.longcat.chat, api.minimaxi.com, api.notion.com, api.openai.com, api.search.brave.com, api.siliconflow.cn, api.tavily.com, api.xiaomimimo.com, astral.sh, auth.openai.com, chatgpt.com, dom.spec.whatwg.org, fetch.spec.whatwg.org, git-scm.com, gitcode.com, github.com, goproxy.cn, html.duckduckgo.com, hub.fastgit.xyz, jimmy.warting.se, json-schema.org, kkgithub.com, linear.app, lists.w3.org, mimesniff.spec.whatwg.org, mirrors.aliyun.com, mirrors.cloud.tencent.com, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, open.bigmodel.cn, platform.deepseek.com, pypi.tuna.tsinghua.edu.cn, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, repo.huaweicloud.com, slack.com, spec.openapis.org, stackoverflow.com, token-plan-cn.xiaomimimo.com, token-plan-sgp.xiaomimimo.com, tools.ietf.org, trac.webkit.org

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || node -e 1 && node scripts/install-git-hooks.mjs || node -e 1

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = patch-package || node -e 1 && node scripts/install-git-hooks.mjs || node -e 1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/chunk-MYXEWXRA.jsView file

11init_esm_shims(); L12: import { spawn, spawnSync as spawnSync2, execFile } from "child_process"; L13: import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-MYXEWXRA.jsView on unpkg · L11

dist/chunk-MI76HD4P.jsView file

2783if (deps.exists(localShim)) { L2784: return { command: `"${localShim}"`, args: args.map(quote), shell: true }; L2785: }

High

Shell

Package source references shell execution.

dist/chunk-MI76HD4P.jsView on unpkg · L2783

111"*.map", L112: "package-lock.json", L113: "yarn.lock", ... L184: init_esm_shims(); L185: function applyCommandFilter(command, stdout, exitCode) { L186: const cmd = command.trim(); ... L825: try { L826: const parsed = JSON.parse(content); L827: if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) { ... L1398: init_esm_shims(); L1399: import { execFile } from "child_process"; L1400: import { access, readFile as readFile2, unlink as unlink2 } from "fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-MI76HD4P.jsView on unpkg · L111

dist/chunk-MU4IFTDZ.jsView file

26199function install() { L26200: globalThis.fetch = module.exports.fetch; L26201: globalThis.Headers = module.exports.Headers; ... L26203: globalThis.Request = module.exports.Request; L26204: globalThis.FormData = module.exports.FormData; L26205: globalThis.WebSocket = module.exports.WebSocket; L26206: globalThis.CloseEvent = module.exports.CloseEvent;

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/chunk-MU4IFTDZ.jsView on unpkg · L26199

•Trigger-reachable chain: manifest.bin -> dist/main.js -> dist/chunk-MU4IFTDZ.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-MU4IFTDZ.jsView on unpkg

67listSkillFiles, L68: rewritePowershellNullRedirect, L69: rewriteWindowsNullRedirect, ... L128: L129: // node_modules/undici/lib/core/symbols.js L130: var require_symbols = __commonJS({ ... L155: kBodyUsed: /* @__PURE__ */ Symbol("used"), L156: kBody: /* @__PURE__ */ Symbol("abstracted request body"), L157: kRunning: /* @__PURE__ */ Symbol("running"), ... L272: * @type {-2|-1|0|1} L273: * @private L274: */

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-MU4IFTDZ.js

dist/chunk-KZWA4JOC.jsView file

27680} L27681: return new Promise((resolve4) => { L27682: const child = spawn(command, { L27683: shell: true, ... L27688: let lastErr = ""; L27689: const stdoutDecoder = new WinStreamDecoder(); L27690: const stderrDecoder = new WinStreamDecoder(); L27691: child.stdout?.on("data", (data) => { L27692: emitLines(stdoutDecoder.write(data), onLine); L27693: lastErr = "";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-KZWA4JOC.jsView on unpkg · L27680

355if (existsSync(licensePath)) { L356: const key2 = readFileSync(licensePath, "utf8").trim(); L357: if (key2) { ... L4020: init_esm_shims(); L4021: import { execFileSync } from "child_process"; L4022: var LSP_SERVERS = [ ... L10278: id; L10279: baseUrl; L10280: apiKey; ... L28925: /doctor \u2014 Environment health check (Node/Git/Python/uv) + which shell the bash tool uses L28926: /tools \u2014 Show available tools and their descriptions L28927: /compact \u2014 Compact context (summarize old messages)

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-KZWA4JOC.jsView on unpkg · L355

45Cross-file remote execution chain: dist/chunk-KZWA4JOC.js spawns dist/chunk-MU4IFTDZ.js; helper contains network access plus dynamic code execution. L45: renderRecoveryStack, L46: require_undici, L47: resolveProxyForUrl, ... L345: function defaultLicensePath() { L346: return join(homedir(), ".rivet", "pro.license"); L347: } ... L351: } L352: if (process.env.RIVET_PRO === "1") { L353: return { enabled: true, source: "env" }; ... L820: let h = 0; L821: for (let i = 0; i < s.length; i++) h = Math.imul(31, h) + s.charCodeAt(i) | 0; L822: return (h >>> 0).toString(16);

dist/chunk-ANIOZTNE.jsView file

14init_esm_shims(); L15: import { execFile } from "child_process"; L16: import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "fs"; ... L51: label: "system service / daemon control (a background process or service state changed)", L52: test: /\b(systemctl|service)\s+(start|stop|restart|enable|disable|reload)\b|\blaunchctl\s+(load|unload|bootstrap|bootout)\b|\bpm2\s+(start|stop|restart|delete)\b|\b(brew\s+services... L53: } ... L94: try { L95: return JSON.parse(readFileSync(file, "utf-8")); L96: } catch { ... L137: async function gitLines(cwd, args) { L138: const { stdout } = await execFileP("git", ["-c", "core.quotePath=false", ...args], { cwd, timeout: 5e3, encoding: "utf-8" }); L139: return stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-ANIOZTNE.jsView on unpkg · L14

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

dist/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tianshu-tui@2.19.4 matchedIdentity = npm:dGlhbnNodS10dWk:2.19.4 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 18-58json

18 "url": "git+https://github.com/huiliyi37/Tianshu-Tui.git"

19 },

20 "bugs": {

21 "url": "https://github.com/huiliyi37/Tianshu-Tui/issues"

22 },

23 "engines": {

24 "node": ">=24"

25 },

26 "files": [

27 "dist/",

28 "!dist/node_modules",

29 "!dist/native",

30 "README.md",

31 "LICENSE",

32 "completions/"

33 ],

34 "bin": {

35 "rivet": "dist/main.js"

36 },

37 "scripts": {

38 "postinstall": "patch-package || node -e 1 && node scripts/install-git-hooks.mjs || node -e 1",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L38

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "prepublishOnly": "npm run build",

40 "dev": "tsup --watch",

41 "build": "tsup",

42 "start": "node --expose-gc --max-old-space-size=4096 dist/main.js",

43 "typecheck": "tsc --noEmit",

44 "typecheck:baseline": "tsx scripts/typecheck-baseline.ts",

45 "test": "tsx scripts/run-node-tests.ts",

46 "test:unit": "tsx scripts/run-node-tests.ts --unit",

47 "test:integration": "tsx scripts/run-node-tests.ts --integration",

48 "test:fast": "tsx scripts/run-node-tests.ts --exclude-tui",

49 "test:desktop": "node --import ./desktop/scripts/test-alias-register.mjs --import tsx --test-force-exit --test 'desktop/src/**/__tests__/*.test.ts'",

50 "test:incremental": "tsx scripts/test-incremental.ts",

51 "cache:audit": "tsx src/cache/cache-audit-cli.ts",

52 "tokens:audit": "tsx scripts/analyze-output-tokens.ts",

53 "diagnose:orphans": "tsx scripts/diagnose-tool-orphans.ts",

54 "benchmark": "tsx scripts/run-benchmark.ts"

55 },

56 "dependencies": {

57 "@ast-grep/lang-json": "^0.0.7",

58 "@ast-grep/lang-python": "^0.0.6",

dist/chunk-MYXEWXRA.jsView file

Lines 1-31javascript

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096

2import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);

3import {

4 loadConfig

dist/chunk-MI76HD4P.jsView file

Lines 2763-2803javascript

2763 this.timer = this.scheduler.setTimeout(() => {

2764 this.timer = void 0;

2765 this.flush();

dist/chunk-MU4IFTDZ.jsView file

26199function install() { L26200: globalThis.fetch = module.exports.fetch; L26201: globalThis.Headers = module.exports.Headers; ... L26203: globalThis.Request = module.exports.Request; L26204: globalThis.FormData = module.exports.FormData; L26205: globalThis.WebSocket = module.exports.WebSocket; L26206: globalThis.CloseEvent = module.exports.CloseEvent;

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/chunk-MU4IFTDZ.jsView on unpkg · L26199

•Trigger-reachable chain: manifest.bin -> dist/main.js -> dist/chunk-MU4IFTDZ.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-MU4IFTDZ.jsView on unpkg

67listSkillFiles, L68: rewritePowershellNullRedirect, L69: rewriteWindowsNullRedirect, ... L128: L129: // node_modules/undici/lib/core/symbols.js L130: var require_symbols = __commonJS({ ... L155: kBodyUsed: /* @__PURE__ */ Symbol("used"), L156: kBody: /* @__PURE__ */ Symbol("abstracted request body"), L157: kRunning: /* @__PURE__ */ Symbol("running"), ... L272: * @type {-2|-1|0|1} L273: * @private L274: */

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-MU4IFTDZ.js

dist/chunk-KZWA4JOC.jsView file

27680} L27681: return new Promise((resolve4) => { L27682: const child = spawn(command, { L27683: shell: true, ... L27688: let lastErr = ""; L27689: const stdoutDecoder = new WinStreamDecoder(); L27690: const stderrDecoder = new WinStreamDecoder(); L27691: child.stdout?.on("data", (data) => { L27692: emitLines(stdoutDecoder.write(data), onLine); L27693: lastErr = "";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-KZWA4JOC.jsView on unpkg · L27680

355if (existsSync(licensePath)) { L356: const key2 = readFileSync(licensePath, "utf8").trim(); L357: if (key2) { ... L4020: init_esm_shims(); L4021: import { execFileSync } from "child_process"; L4022: var LSP_SERVERS = [ ... L10278: id; L10279: baseUrl; L10280: apiKey; ... L28925: /doctor \u2014 Environment health check (Node/Git/Python/uv) + which shell the bash tool uses L28926: /tools \u2014 Show available tools and their descriptions L28927: /compact \u2014 Compact context (summarize old messages)

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-KZWA4JOC.jsView on unpkg · L355

45Cross-file remote execution chain: dist/chunk-KZWA4JOC.js spawns dist/chunk-MU4IFTDZ.js; helper contains network access plus dynamic code execution. L45: renderRecoveryStack, L46: require_undici, L47: resolveProxyForUrl, ... L345: function defaultLicensePath() { L346: return join(homedir(), ".rivet", "pro.license"); L347: } ... L351: } L352: if (process.env.RIVET_PRO === "1") { L353: return { enabled: true, source: "env" }; ... L820: let h = 0; L821: for (let i = 0; i < s.length; i++) h = Math.imul(31, h) + s.charCodeAt(i) | 0; L822: return (h >>> 0).toString(16);

dist/chunk-ANIOZTNE.jsView file

Lines 1-34javascript

1#!/usr/bin/env -S node --expose-gc --max-old-space-size=4096

2import { createRequire as __rivetCreateRequire } from 'node:module'; const require = __rivetCreateRequire(import.meta.url);

3import {

4 rivetHome

completions/rivet.bashView file

•path = completions/rivet.bash kind = build_helper sizeBytes = 1003 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/rivet.bashView on unpkg

dist/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tianshu-tui@2.19.4 matchedIdentity = npm:dGlhbnNodS10dWk:2.19.4 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/main.jsView on unpkg