network-ai - npm Package Compare versions

Comparing version 3.4.0 to 3.4.1

dist/lib/locked-blackboard.js

@@ -54,3 +54,3 @@ "use strict";
         // recursive: true is idempotent — no existsSync check needed
-        (0, fs_1.mkdirSync)(dir, { recursive: true });
+        (0, fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
     }
@@ -221,6 +221,8 @@ /**
     constructor(basePath = '.', auditLoggerOrOptions, options) {
-        this.basePath = basePath;
-        this.blackboardPath = (0, path_1.join)(basePath, 'swarm-blackboard.md');
-        this.lockPath = (0, path_1.join)(basePath, 'data', '.blackboard.lock');
-        this.pendingDir = (0, path_1.join)(basePath, 'data', 'pending_changes');
+        // Resolve to an absolute path to prevent insecure relative/temp-dir path propagation
+        const resolvedBase = (0, path_1.resolve)(basePath);
+        this.basePath = resolvedBase;
+        this.blackboardPath = (0, path_1.join)(resolvedBase, 'swarm-blackboard.md');
+        this.lockPath = (0, path_1.join)(resolvedBase, 'data', '.blackboard.lock');
+        this.pendingDir = (0, path_1.join)(resolvedBase, 'data', 'pending_changes');
         this.lock = new FileLock(this.lockPath);
@@ -242,6 +244,6 @@ // Support both signatures:
         if (!(0, fs_1.existsSync)((0, path_1.dirname)(this.blackboardPath))) {
-            (0, fs_1.mkdirSync)((0, path_1.dirname)(this.blackboardPath), { recursive: true });
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(this.blackboardPath), { recursive: true, mode: 0o700 });
         }
         if (!(0, fs_1.existsSync)(this.pendingDir)) {
-            (0, fs_1.mkdirSync)(this.pendingDir, { recursive: true });
+            (0, fs_1.mkdirSync)(this.pendingDir, { recursive: true, mode: 0o700 });
         }
@@ -386,3 +388,3 @@ // Initialize blackboard file if needed
         if (!(0, fs_1.existsSync)(archiveDir)) {
-            (0, fs_1.mkdirSync)(archiveDir, { recursive: true });
+            (0, fs_1.mkdirSync)(archiveDir, { recursive: true, mode: 0o700 });
         }
@@ -389,0 +391,0 @@ const sourcePath = (0, path_1.join)(this.pendingDir, `${change.change_id}.json`);

package.json

 {
   "name": "network-ai",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "AI agent orchestration framework for TypeScript/Node.js - plug-and-play multi-agent coordination with 12 frameworks (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw). Built-in security, swarm intelligence, and agentic workflow patterns.",
@@ -5,0 +5,0 @@ "main": "dist/index.js",

README.md

@@ -7,3 +7,3 @@ # Network-AI: Multi-Agent Orchestration Framework
 [![CodeQL](https://github.com/jovanSAPFIONEER/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/jovanSAPFIONEER/Network-AI/actions/workflows/codeql.yml)
-[![Release](https://img.shields.io/badge/release-v3.4.0-blue.svg)](https://github.com/jovanSAPFIONEER/Network-AI/releases)
+[![Release](https://img.shields.io/badge/release-v3.4.1-blue.svg)](https://github.com/jovanSAPFIONEER/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
@@ -10,0 +10,0 @@ [![ClawHub](https://img.shields.io/badge/ClawHub-network--ai-orange.svg)](https://clawhub.ai/skills/network-ai)

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

955636

0.04%

Lines of code

14784

0.01%

No dependency changes