wienerdog@0.8.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wienerdog@0.8.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

src/core/vault.jsView file

6const crypto = require('node:crypto'); L7: const { execFileSync, spawnSync } = require('node:child_process'); L8: const { WienerdogError } = require('./errors'); ... L10: L11: const TEMPLATE_ROOT = path.join(__dirname, '..', '..', 'templates', 'vault'); L12: ... L14: function today() { L15: if (process.env.WIENERDOG_FAKE_TODAY) return process.env.WIENERDOG_FAKE_TODAY; L16: return new Date().toISOString().slice(0, 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/vault.jsView on unpkg · L6

src/scheduler/status.jsView file

3const path = require('node:path'); L4: const { spawnSync } = require('node:child_process'); L5: const manifestLib = require('../core/manifest'); ... L17: * @param {{path:string, unload?:string[]}} entry L18: * @returns {{name:string, scheduler:'launchd'|'systemd'|'schtasks', L19: * probe:string[], reload:string[]}|null} ... L55: /** L56: * Default read-only probe: run `argv` and map the exit code. Honors the test L57: * seams so a test NEVER touches the real OS scheduler: ... L66: function defaultProbe(argv) { L67: if (process.env.WIENERDOG_LOADER_NOOP) return 'unknown'; L68: if (process.env.WIENERDOG_TEST_NO_REAL_SCHEDULER) return 'unknown';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/scheduler/status.jsView on unpkg · L3

templates/hooks/codex-session-end.shView file

•path = templates/hooks/codex-session-end.sh kind = build_helper sizeBytes = 944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/hooks/codex-session-end.shView on unpkg

src/core/tarball.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = wienerdog@0.7.1 matchedIdentity = npm:d2llbmVyZG9n:0.7.1 similarity = 0.596 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/tarball.jsView on unpkg

Source & flagged code

4 flagged

src/core/vault.jsView file

Lines 1-26javascript

1'use strict';

2

3const fs = require('node:fs');

4const os = require('node:os');

5const path = require('node:path');

6const crypto = require('node:crypto');

7const { execFileSync, spawnSync } = require('node:child_process');

8const { WienerdogError } = require('./errors');

9const manifestLib = require('./manifest');

10

11const TEMPLATE_ROOT = path.join(__dirname, '..', '..', 'templates', 'vault');

12

13/** @returns {string} today's date as YYYY-MM-DD, or WIENERDOG_FAKE_TODAY if set. */

14function today() {

15 if (process.env.WIENERDOG_FAKE_TODAY) return process.env.WIENERDOG_FAKE_TODAY;

16 return new Date().toISOString().slice(0, 10);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/vault.jsView on unpkg · L6

17}

18

19/** @param {string[]} args @param {string} cwd @returns {boolean} true if git exited 0. */

20function gitOk(args, cwd) {

21 const result = spawnSync('git', args, { cwd });

22 return !result.error && result.status === 0;

23}

24

25/** @throws {WienerdogError} if git is not installed. */

26function assertGitInstalled() {

src/scheduler/status.jsView file

Lines 1-23javascript

1'use strict';

2const fs = require('node:fs');

3const path = require('node:path');

4const { spawnSync

templates/hooks/codex-session-end.shView file

•path = templates/hooks/codex-session-end.sh kind = build_helper sizeBytes = 944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/hooks/codex-session-end.shView on unpkg

src/core/tarball.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = wienerdog@0.7.1 matchedIdentity = npm:d2llbmVyZG9n:0.7.1 similarity = 0.596 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/tarball.jsView on unpkg