xibecode: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

5 flagged

dist/ui/claude-style-chat.jsView file

Lines 1-23javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';

3import { createRequire } from 'module';

4import { spawn } from 'child_process';

5import TextInput from 'ink-text-input';

High

Child Process

Package source references child process execution.

dist/ui/claude-style-chat.jsView on unpkg · L3

6import { Box, Static, Text, createRoot, useApp, useInput } from '../ink.js';

7import * as fs from 'fs/promises';

8import * as path from 'path';

9import { ConfigManager, PROVIDER_CONFIGS, listSetupProviders } from '../utils/config.js';

10import { EnhancedAgent } from 'xibecode-core';

11const pkg = createRequire(import.meta.url)('../../package.json');

12import { CodingToolExecutor, NeuralMemory } from 'xibecode-core';

13import { MCPClientManager } from 'xibecode-core';

14import { SkillManager } from 'xibecode-core';

15import { builtInSkillsDir } from '../utils/built-in-skills-dir.js';

16import { ENABLED_MODES, MODE_CONFIG } from 'xibecode-core';

17import { renderAndRun } from '../interactiveHelpers.js';

18import { AssistantMarkdown } from '../components/AssistantMarkdown.js';

19import { formatToolArgs, formatToolOutcome, formatRunSwarmDetailLines } from '../utils/tool-display.js';

20import { SPINNER_VERBS } from '../constants/spinnerVerbs.js';

21import { collectImageReferencesForPrompt } from 'xibecode-core';

22import { loadImageAttachment, mimeFromExtension } from '../utils/image-attachments.js';

23import { SessionManager } from 'xibecode-core';

dist/commands/diagnostics.jsView file

Lines 1-29javascript

1import * as fs from 'fs/promises';

2import * as path from 'path';

3import { createRequire } from 'module';

dist/ui/enhanced-tui.jsView file

Lines 1-25javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import { formatRunSwarmDetailLines, formatToolOutcome } from '../utils/tool-display.js';

4import { getTheme } from './themes.js';

dist/commands/mcp.jsView file

Lines 203-238javascript

203 name: 'query',

204 message: 'Search query:'

205 }]);

206 await handleSearch(ui, query);

207 // Prompt to install from search results?

208 // For simplicity, just list for now and let user copy command.

dist/commands/setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = xibecode@1.4.2 matchedIdentity = npm:eGliZWNvZGU:1.4.2 similarity = 0.790 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/setup.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/ui/claude-style-chat.jsView file

3import { createRequire } from 'module'; L4: import { spawn } from 'child_process'; L5: import TextInput from 'ink-text-input';

High

Child Process

Package source references child process execution.

dist/ui/claude-style-chat.jsView on unpkg · L3

dist/commands/diagnostics.jsView file

9import { ConfigManager } from '../utils/config.js'; L10: const execAsync = promisify(exec); L11: const require = createRequire(import.meta.url);

High

Shell

Package source references shell execution.

dist/commands/diagnostics.jsView on unpkg · L9

dist/ui/enhanced-tui.jsView file

5import { createRequire } from 'module'; L6: const require = createRequire(import.meta.url); L7: const { version: VERSION } = require('../../package.json');

xibecode: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

dist/ui/claude-style-chat.jsView file

Lines 1-23javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';

3import { createRequire } from 'module';

4import { spawn } from 'child_process';

5import TextInput from 'ink-text-input';

High

Child Process

Package source references child process execution.

dist/ui/claude-style-chat.jsView on unpkg · L3

6import { Box, Static, Text, createRoot, useApp, useInput } from '../ink.js';

7import * as fs from 'fs/promises';

8import * as path from 'path';

9import { ConfigManager, PROVIDER_CONFIGS, listSetupProviders } from '../utils/config.js';

10import { EnhancedAgent } from 'xibecode-core';

11const pkg = createRequire(import.meta.url)('../../package.json');

12import { CodingToolExecutor, NeuralMemory } from 'xibecode-core';

13import { MCPClientManager } from 'xibecode-core';

14import { SkillManager } from 'xibecode-core';

15import { builtInSkillsDir } from '../utils/built-in-skills-dir.js';

16import { ENABLED_MODES, MODE_CONFIG } from 'xibecode-core';

17import { renderAndRun } from '../interactiveHelpers.js';

18import { AssistantMarkdown } from '../components/AssistantMarkdown.js';

19import { formatToolArgs, formatToolOutcome, formatRunSwarmDetailLines } from '../utils/tool-display.js';

20import { SPINNER_VERBS } from '../constants/spinnerVerbs.js';

21import { collectImageReferencesForPrompt } from 'xibecode-core';

22import { loadImageAttachment, mimeFromExtension } from '../utils/image-attachments.js';

23import { SessionManager } from 'xibecode-core';

dist/commands/diagnostics.jsView file

Lines 1-29javascript

1import * as fs from 'fs/promises';

2import * as path from 'path';

3import { createRequire } from 'module';

dist/ui/enhanced-tui.jsView file

Lines 1-25javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import { formatRunSwarmDetailLines, formatToolOutcome } from '../utils/tool-display.js';

4import { getTheme } from './themes.js';

dist/commands/mcp.jsView file

Lines 203-238javascript

203 name: 'query',

204 message: 'Search query:'

205 }]);

206 await handleSearch(ui, query);

207 // Prompt to install from search results?

208 // For simplicity, just list for now and let user copy command.

dist/commands/setup.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/setup.jsView on unpkg

xibecode@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Runtime surface

Behavioral surface

Source & flagged code