npm analyzed 0.2.69

@iola_adm/iola-cli

v0.2.69

npm

CLI и AI-агент городского округа Йошкар-Ола.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsnpm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.2.69 · analyzer v17 · 1d ago

dynamic code executionnew Function()package/src/cli.js:20027const value = await page.evaluate(new Function("return (" + params.script + ")"));

code evidencev0.2.69 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs package/bin/postinstall.js :4 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
fs package/src/cli.js :2 import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";

shell package/bin/postinstall.js :2 import { spawn } from "node:child_process";
shell package/src/cli.js :1 import { execFile, spawn } from "node:child_process";

net package/bin/postinstall.js :146 const response = await fetch(url, { signal: controller.signal });
net package/src/cli.js :3 import { createServer } from "node:http";

secrets package/src/cli.js :1174 const openai = Boolean(process.env.OPENAI_API_KEY || secrets.openai?.apiKey);