parket-flow @3.0.1

Summary

index.js imports child_process and invokes execSync with bash and zsh shells (index.js line 1, 301, 317). Without traced execution context it is not possible to determine whether these shell invocations are part of legitimate tool functionality or whether they fetch and execute attacker-controlled content. No corroborating evidence of exfiltration, credential access, network beacons, or attacker-controlled endpoints is present in what was inspected. Recommend human review of the shell command construction and any inputs they consume before allowing or blocking.

Source: amazon-inspector (8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd)