zcode-starterkit@1.7.17: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

zcode-starterkit@1.7.17: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

baseline/hooks-plugin/hooks/rtk.mjsView file

22import { fileURLToPath, pathToFileURL } from 'node:url' L23: import { spawnSync } from 'node:child_process' L24:

High

Child Process

Package source references child process execution.

baseline/hooks-plugin/hooks/rtk.mjsView on unpkg · L22

src/rtk.mjsView file

198if (archivePath.endsWith('.zip')) { L199: const ps = platform === 'win32' ? 'powershell.exe' : 'pwsh' L200: const result = spawnSync(ps, ['-NoProfile', '-Command', `Expand-Archive -Force -LiteralPath '${archivePath.replaceAll("'", "''")}' -DestinationPath '${extractDir.replaceAll("'", "'...

High

Shell

Package source references shell execution.

src/rtk.mjsView on unpkg · L198

13import path from 'node:path' L14: import { spawnSync } from 'node:child_process' L15: import { ensureDir, exists } from './fs-utils.mjs' ... L18: export const RTK_REPO = 'rtk-ai/rtk' L19: export const RTK_INSTALL_COMMAND = 'curl -fsSL https://raw.githubusercontent.com/rtk-[redacted].sh | sh' L20: export const RTK_FALLBACK_INSTALL_COMMAND = 'cargo install --git https://github.com/rtk-ai/rtk' ... L25: if (!exists(filePath)) return fallback L26: return JSON.parse(fs.readFileSync(filePath, 'utf8')) L27: } catch { ... L55: L56: function pathEntries(env = process.env, platform = process.platform) { L57: const delimiter = platform === 'win32' ? ';' : ':'

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/rtk.mjsView on unpkg · L13

baseline/mcp-tools/dist/mcp/server.jsView file

2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

baseline/mcp-tools/dist/mcp/server.jsView on unpkg · L2941

baseline/hooks-plugin/hooks/sqlite-open.mjsView file

4// 1. better-sqlite3 (FTS5 on all platforms) — resolved from: L5: // - require('better-sqlite3') if installed next to hooks L6: // - sibling mcp-tools plugin cache (packaged with native module)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

baseline/hooks-plugin/hooks/sqlite-open.mjsView on unpkg · L4

src/plugin-packager.mjsView file

2Cross-file remote execution chain: src/plugin-packager.mjs spawns baseline/mcp-tools/dist/mcp/server.js; helper contains network access plus dynamic code execution. L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: import { ... L42: return { L43: $schema: 'https://json.schemastore.org/package.json', L44: name: `@zcode-starterkit/${name}-plugin`, ... L128: // ZCode loads hooks.json from the plugin root and runs each command, passing L129: // JSON on stdin and reading a JSON decision/context payload on stdout. L130: function packageHooksPlugin({ hooksDir, baselineRoot }) { ... L267: const result = spawnSync( L268: process.platform === 'win32' ? 'npm.cmd' : 'npm', L269: ['install', '--omit=dev', '--no-fund', '--no-audit'],

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/plugin-packager.mjsView on unpkg · L2

baseline/hooks-plugin/hooks/guard.cmdView file

•path = baseline/hooks-plugin/hooks/guard.cmd kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

baseline/hooks-plugin/hooks/guard.cmdView on unpkg

src/codebase-memory.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = zcode-starterkit@1.7.7 matchedIdentity = npm:emNvZGUtc3RhcnRlcmtpdA:1.7.7 similarity = 0.447 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codebase-memory.mjsView on unpkg

baseline/skills/security-and-hardening/SKILL.mdView file

104patternName = generic_password severity = medium line = 104 matchedText = console.... });

Medium

Secret Pattern

Hardcoded password in baseline/skills/security-and-hardening/SKILL.md

baseline/skills/security-and-hardening/SKILL.mdView on unpkg · L104

Source & flagged code

9 flagged

baseline/hooks-plugin/hooks/rtk.mjsView file

Lines 2-42javascript

2// rtk hook — ported from opencode-starterkit baseline/plugin/rtk.ts.

3// ZCode hook event: PreToolUse (rewrite bash/shell command for token savings).

4//

5// Requires: rtk >= 0.23.0 in PATH. If rtk is missing, the hook is a no-op.

6// Reads JSON stdin, emits JSON stdout with hookSpecificOutput.updatedInput

7// (ZCode v3.3+ PreToolUse protocol) when rtk rewrites.

8// Plain JS (no TypeScript) so Node runs it directly.

9//

10// Implementation note (v1.7.4): rtk rewrite exits with status 3 when the

11// rewrite is successful but the original output is partial/incomplete

12// (e.g. rewriting `rg`/`grep` — the proxy itself doesn't fully parse the

13// output before returning). We use spawnSync (not execSync) and accept

14// status 0 OR 3 as "rewrite happened" so rg/grep compressions are not lost.

15//

16// Local expansions (beyond bare rtk rewrite):

17// - npm/pnpm test → npm/pnpm run test (forms rtk rewrite understands)

18// - node --test / yarn test / bun test → rtk test -- <cmd> fallback

19

20import fs from 'node:fs'

21import path from 'node:path'

22import { fileURLToPath, pathToFileURL } from 'node:url'

23import { spawnSync } from 'node:child_process'

24

High

Child Process

Package source references child process execution.

baseline/hooks-plugin/hooks/rtk.mjsView on unpkg · L22

25// Statuses the rtk proxy returns when a rewrite is applied. Exit 0 is the

26// normal happy path; exit 3 means the proxy emitted a partial rewrite

27// (common for grep/rg compression). Any other status is treated as no-op.

28const REWRITE_STATUSES = new Set([0, 3])

29

30// Idempotency guard: if the command already routes through rtk, skip.

31// Same regex as the opencode donor (handles env-var prefixes too).

32const IDEMPOTENT_RE = /^\s*(?:RTK_[A-Z_]+=\S+\s+)*rtk\b/

33

34// Match a shell tool. ZCode hook protocol uses lowercase tool_name; the

35// matcher in hooks.json normalizes the casing for us, but be lenient.

36const SHELL_TOOLS = new Set(['bash', 'shell', 'execute_bash', 'run_command', 'terminal'])

37const RUNTIME_CONFIG_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'rtk.json')

38

39// Leading env assignments (FOO=1 BAR=baz npm test). Keep them attached so

40// rewrite still sees the real command after the env prefix.

41const LEADING_ENV_RE = /^((?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*)/

42

src/rtk.mjsView file

Lines 1-33javascript

1// rtk installer/detector/state — ported from opencode-starterkit src/rtk.mjs.

2// Auto-installs the rtk binary if missing, detects it across PATH +

3// common global bin dirs, records integration state in the shared

4// starterkit-state.json, and exposes a resolveRtkSetup pipeline that

5// mirrors resolveCodebaseMemorySetup / resolveWebclawSetup.

6//

7// All platforms (win32, linux, darwin) auto-download the correct

8// release binary from GitHub. The old Unix-only install.sh path is

9// kept as a fallback for edge cases.

10

11

baseline/mcp-tools/dist/mcp/server.jsView file

2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

baseline/mcp-tools/dist/mcp/server.jsView on unpkg · L2941

baseline/hooks-plugin/hooks/sqlite-open.mjsView file

Lines 1-24javascript

1// Shared SQLite open + FTS schema helpers for hooks.

2//

3// Backend priority:

4// 1. better-sqlite3 (FTS5 on all platforms) — resolved from:

5// - require('better-sqlite3') if installed next to hooks

6// - sibling mcp-tools plugin cache (packaged with native module)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

baseline/hooks-plugin/hooks/sqlite-open.mjsView on unpkg · L4

7// 2. node:sqlite (Node 22+) — may lack fts5 on Windows

8//

src/plugin-packager.mjsView file

Lines 1-22javascript

1import fs from 'node:fs'

2import path from 'node:path'

3import { spawnSync } from 'node:child_process'

4import {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/plugin-packager.mjsView on unpkg · L2

baseline/hooks-plugin/hooks/guard.cmdView file

•path = baseline/hooks-plugin/hooks/guard.cmd kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

baseline/hooks-plugin/hooks/guard.cmdView on unpkg

src/codebase-memory.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = zcode-starterkit@1.7.7 matchedIdentity = npm:emNvZGUtc3RhcnRlcmtpdA:1.7.7 similarity = 0.447 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codebase-memory.mjsView on unpkg

baseline/skills/security-and-hardening/SKILL.mdView file

Lines 84-124markdown

84import bcrypt from "bcrypt";

85const hash = await bcrypt.hash(password, 12); // cost factor 12

86const valid = await bcrypt.compare(input, hash);

87

88// ✅ Session management

89const session = {

90 httpOnly: true, // No JS access

91 secure: true, // HTTPS only

92 sameSite: "lax", // CSRF protection

93 maxAge: 3600, // 1 hour expiry

94};