Security findings in executable artifacts
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 7.5k
- Forks
- 729
- PR merge metrics
- No merged PRs in 30d
Description
Security Findings in Executable Artifacts
While auditing NL programming artifacts in this repository, our scanner detected potential security issues in executable files.
Findings
| # | Severity | File | Line | Pattern | Description |
|---|---|---|---|---|---|
| 1 | High | scripts/check-i18n-consistency.js | 91 | eval-equivalent (new Function) | new Function(\return ${str}`)()` evaluates translation file content as JavaScript; if a translation file is maliciously crafted, arbitrary code executes in the developer's environment |
| 2 | High | package.json | 42 | postinstall-script | "prepare": "husky" runs automatically on npm install; standard husky pattern but executes code on install — see false_positive note in sidecar |
About This Report
These findings come from NLPM's security scanner, which checks executable surfaces (hooks, scripts, MCP configs, dependencies) against known-dangerous patterns.
We may be wrong — false positives happen. If any finding is intentional or already mitigated, please close this issue. If a finding is genuine and you'd like a fix PR, let us know.
Full audit report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/refly-ai-refly.md
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with scripts/check-i18n-consistency.js at line 91 and inspect how translation file content reaches new Function, then review package.json around line 42 and the linked full audit report. Done means determining whether each finding is genuine or a false positive and documenting the outcome or preparing a focused fix PR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100