zcode-acp-server@0.49.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

zcode-acp-server@0.49.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/remote/hub-upgrade-notify.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/remote/hub-upgrade-notify.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/remote/hub-sandbox.jsView file

14Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/bin/hub.js -> dist/remote/hub-sandbox.js L14: */ L15: import { execFileSync } from "node:child_process"; L16: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: /** Whether this process was born inside our Seatbelt wrap. */ L30: export function sandboxBorn(env = process.env) { L31: return process.platform === "darwin" && (env[SANDBOX_ACTIVE_ENV] ?? "").trim() !== ""; L32: } ... L41: /** L42: * The LaunchAgent plist body: run the hub entry under this node, with THIS L43: * process's env minus the birth marker (so the relaunched hub does not ... L122: try { L123: execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "ignore" });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/remote/hub-sandbox.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.32.0 matchedPath = dist/remote/hub-sandbox.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.32.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/remote/hub-sandbox.jsView on unpkg

14*/ L15: import { execFileSync } from "node:child_process"; L16: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: /** Whether this process was born inside our Seatbelt wrap. */ L30: export function sandboxBorn(env = process.env) { L31: return process.platform === "darwin" && (env[SANDBOX_ACTIVE_ENV] ?? "").trim() !== ""; L32: } ... L41: /** L42: * The LaunchAgent plist body: run the hub entry under this node, with THIS L43: * process's env minus the birth marker (so the relaunched hub does not ... L122: try { L123: execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "ignore" });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/remote/hub-sandbox.jsView on unpkg · L14

dist/backend/resolve.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/resolve.js#virtual:normalized:round1View on unpkg

dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.32.0 matchedPath = dist/runtime.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.32.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/remote/hub-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zcode-acp-server@0.37.2 matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.2 similarity = 0.356 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote/hub-server.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 29-69json

29 "main": "dist/index.js",

30 "types": "dist/index.d.ts",

31 "files": [

32 "dist",

33 "assets",

34 "README.md",

35 "LICENSE",

36 "docs"

37 ],

38 "scripts": {

39 "build": "tsc && node scripts/write-code-fingerprint.mjs && node dist/remote/hub-upgrade-notify.js",

40 "dev": "tsc --watch",

41 "typecheck": "tsc --noEmit",

42 "test": "vitest run",

43 "test:watch": "vitest",

44 "format": "prettier --write src",

45 "lint": "eslint .",

46 "smoke": "node dist/index.js < /dev/null",

47 "smoke:tui": "node dist/cli.js tui --check",

48 "prepublishOnly": "pnpm run build && pnpm run test",

49 "postinstall": "node dist/remote/hub-upgrade-notify.js 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "dependencies": {

52 "@agentclientprotocol/sdk": "^1.3.0",

53 "ws": "^8.21.3",

54 "zcode-acp-martty": "0.2.39-zcode.5"

55 },

56 "peerDependencies": {

57 "zod": "^3.25.0 || ^4.0.0"

58 },

59 "devDependencies": {

60 "@eslint/js": "^9.0.0",

61 "@types/node": "^22.0.0",

62 "@types/ws": "^8.18.1",

63 "@typescript-eslint/eslint-plugin": "^8.0.0",

64 "@typescript-eslint/parser": "^8.0.0",

65 "eslint": "^9.0.0",

66 "prettier": "^3.3.0",

67 "typescript": "^5.4.0",

68 "vitest": "^2.0.0",

69 "zod": "^3.25.0"

dist/remote/hub-sandbox.jsView file

Lines 1-34javascript

1/**

2 * Hub sandbox self-relaunch (macOS / launchd).

3 *

4 * A hub born inside our Seatbelt wrap cannot do its job: `open -a Terminal`

5 * for the visible REPL (ADR-0016) gets TCC-attributed to the requester

6 * identity "Sandbox" and Terminal silently refuses the document — while

7 * `open` itself exits 0, so the incubation just burns its budget and every

8 * remote session-create fails. Seatbelt cannot be escaped from within (it

9 * is inherited unconditionally across fork/exec), so the only way out is a

10 * process that already lives OUTSIDE the sandbox: launchd. The wrapped hub

dist/backend/resolve.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/resolve.js#virtual:normalized:round1View on unpkg

dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.32.0 matchedPath = dist/runtime.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.32.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/remote/hub-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zcode-acp-server@0.37.2 matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.2 similarity = 0.356 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote/hub-server.jsView on unpkg