@vybestack/llxprt-code
LLxprt Code
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Native launcher installer with ownership checks; documented, non-fetching. | ai | |
| phantom-deps | phantom-dep:read-package-up | AI (phantom-deps): Likely used indirectly/build-time in monorepo; not a malicious indicator. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode is for terminal paste handling, not payload hiding. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used for normal property access in extension loader, not evasion. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Match is inside a doc comment describing path validation, not executed code. | ai | |
| phantom-deps | phantom-dep:ink-big-text | AI (phantom-deps): CLI tool using ink UI components; phantom deps are expected for optional UI libraries. | ai | |
| phantom-deps | phantom-dep:update-notifier | AI (phantom-deps): CLI tool with update-notifier; phantom dep is expected for optional notification feature. | ai | |
| phantom-deps | phantom-dep:ink-link | AI (phantom-deps): CLI tool using ink UI components; phantom deps are expected for optional UI libraries. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are test specs/maps; consistent with active development on a large CLI package. | ai | |
| phantom-deps | phantom-dep:wrap-ansi | AI (phantom-deps): wrap-ansi is a standard CLI utility; phantom-dep finding is a stable false positive for this bundled CLI package. | ai | |
| dependencies | unvetted-dep:ink-testing-library | AI (dependencies): ink-testing-library is a legitimate, well-known testing utility for the ink CLI framework. Its presence as a runtime dep is unusual but not malicious; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:gradient-string | AI (phantom-deps): gradient-string is a legitimate cosmetic dep likely used indirectly via ink-gradient; phantom-dep heuristic fires as false positive for this package. | ai | |
| phantom-deps | phantom-dep:fzf | AI (phantom-deps): Legitimate dependency for AI coding assistant CLI; referenced via monorepo core package delegation pattern, not a security concern. | ai | |
| phantom-deps | phantom-dep:@types/update-notifier | AI (phantom-deps): Type definitions package; framework-scoped, loaded by convention. No security concern. | ai | |
| phantom-deps | phantom-dep:@anthropic-ai/sdk | AI (phantom-deps): Core AI SDK for Anthropic models; expected dependency for a multi-provider AI coding assistant. | ai | |
| phantom-deps | phantom-dep:ink-select-input | AI (phantom-deps): Ink UI component for CLI; appropriate for this CLI tool's monorepo structure. | ai | |
| phantom-deps | phantom-dep:@dqbd/tiktoken | AI (phantom-deps): Token counting library for LLM usage; expected dependency for an AI coding assistant. | ai | |
| phantom-deps | phantom-dep:highlight.js | AI (phantom-deps): Syntax highlighting library appropriate for a coding assistant CLI; monorepo delegation pattern. | ai | |
| phantom-deps | phantom-dep:mime-types | AI (phantom-deps): Standard MIME type utility; used in monorepo core package. Not a security concern. | ai | |
| phantom-deps | phantom-dep:openai | AI (phantom-deps): Core AI SDK dependency for this AI assistant tool; delegated to core package in monorepo structure. | ai | |
| phantom-deps | phantom-dep:diff | AI (phantom-deps): Standard diff utility; used in monorepo core package. Not a security concern. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 0.10.0 | 52 / 23 | |
| 0.9.3 | 44 / 22 | |
| 0.9.2 | 44 / 22 | |
| 0.9.1 | 44 / 22 | |
| 0.9.0 | 44 / 22 | |
| 0.8.1 | 42 / 23 | |
| 0.8.0 | 42 / 23 | |
| 0.7.0 | 41 / 24 | |
| 0.6.2 | 41 / 24 | |
| 0.6.1 | 41 / 24 | |
| 0.6.0 | 41 / 24 | |
| 0.5.0 | 35 / 21 | |
| 0.4.8 | 33 / 21 | |
| 0.4.7 | 33 / 21 | |
| 0.4.6 | 33 / 21 | |
| 0.4.5 | 33 / 21 | |
| 0.4.4 | 33 / 21 | |
| 0.4.3 | 33 / 21 | |
| 0.4.2 | 33 / 21 | |
| 0.4.1 | 33 / 21 | |
| 0.3.4 | 31 / 22 | |
| 0.2.25 | 33 / 22 | |
| 0.2.24 | 33 / 22 | |
| 0.2.3 | 33 / 22 | |
| 0.2.2 | 33 / 22 | |
| 0.1.23 | 33 / 21 | |
| 0.1.22 | 33 / 21 | |
| 0.1.21 | 33 / 21 | |
| 0.1.20 | 33 / 21 | |
| 0.1.19 | 33 / 21 | |
| 0.1.18 | 31 / 21 | |
| 0.1.17 | 31 / 20 | |
| 0.1.16 | 31 / 20 | |
| 0.1.15 | 31 / 20 | |
| 0.1.14 | 31 / 21 | |
| 0.1.12 | 30 / 21 |
v0.10.0
5 findingsScript: node scripts/install-native-launchers.cjs
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/vybestack/llxprt-code/blob/2d228fb17e7881b0f717b00a4eaaf34ba696937e/src/config/extensions/extensionLoader.ts#L348 346 | * Resolve a context file name relative to the extension directory, enforcing 347 | * relative-only realpath containment. Rejects: > 348 | * - Absolute paths (e.g. `/etc/passwd`) 349 | * - Parent directory traversal (e.g. `../../etc/passwd`) 350 | * - Symlink escape (resolved path outside the extension directory)
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/vybestack/llxprt-code/blob/2d228fb17e7881b0f717b00a4eaaf34ba696937e/src/config/extensions/extensionLoader.ts#L349 347 | * relative-only realpath containment. Rejects: 348 | * - Absolute paths (e.g. `/etc/passwd`) > 349 | * - Parent directory traversal (e.g. `../../etc/passwd`) 350 | * - Symlink escape (resolved path outside the extension directory) 351 | * - Sibling escape (resolved path outside the extension directory)
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (acoliver) on 2026-07-25, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.