@adep/cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@adep/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/index.jsView file

31// packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

16} L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L16

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: await handle.writeFile(JSON.stringify(credentials, null, 2)); return { authorization: `Bearer ${decodeToken(credentials.encodedToken)}` }; if (code === "authorization_pending") { headers: { authorization: `Bearer ${token}` }, "content": "# {{name}}\n\n\u5012\u6570\u65E5 / \u7EAA\u5FF5\u65E5\uFF08countdown \u6A21\u677F\uFF09\u2014\u2014\u7531\u5FAE\u4FE1\u5C0F\u7A0B\u5E8F\u300C\u5012\u6570\u65E5\u300D\u7... "content": "/**\n * \u8BF7\u6C42\u9274\u6743\u5355\u5143\u6D4B\u8BD5\uFF1AOIDC \u8EAB\u4EFD\uFF08ctx.user \u2192 `oidc:<\u5E73\u53F0\u7528\u6237 id>` \u6620\u5C04\uFF09\u4E0E\n * d... "content": "/**\n * \u8BF7\u6C42\u

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

84if (mode !== 384) { L85: const { chmod } = await import("node:fs/promises"); L86: await chmod(file2, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L84

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

dist/worker-entry.jsView file

•matchType = normalized_sha256 matchedPackage = @adep/cli@0.1.12 matchedPath = dist/worker-entry.js matchedIdentity = npm:QGFkZXAvY2xp:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worker-entry.jsView on unpkg

Source & flagged code

9 flagged

dist/index.jsView file

31// packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

16} L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L16

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: await handle.writeFile(JSON.stringify(credentials, null, 2)); return { authorization: `Bearer ${decodeToken(credentials.encodedToken)}` }; if (code === "authorization_pending") { headers: { authorization: `Bearer ${token}` }, "content": "# {{name}}\n\n\u5012\u6570\u65E5 / \u7EAA\u5FF5\u65E5\uFF08countdown \u6A21\u677F\uFF09\u2014\u2014\u7531\u5FAE\u4FE1\u5C0F\u7A0B\u5E8F\u300C\u5012\u6570\u65E5\u300D\u7... "content": "/**\n * \u8BF7\u6C42\u9274\u6743\u5355\u5143\u6D4B\u8BD5\uFF1AOIDC \u8EAB\u4EFD\uFF08ctx.user \u2192 `oidc:<\u5E73\u53F0\u7528\u6237 id>` \u6620\u5C04\uFF09\u4E0E\n * d... "content": "/**\n * \u8BF7\u6C42\u

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

84if (mode !== 384) { L85: const { chmod } = await import("node:fs/promises"); L86: await chmod(file2, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L84

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

dist/worker-entry.jsView file

•matchType = normalized_sha256 matchedPackage = @adep/cli@0.1.12 matchedPath = dist/worker-entry.js matchedIdentity = npm:QGFkZXAvY2xp:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worker-entry.jsView on unpkg