13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}uZ.suggestSimilar=tWe});var dZ=h(sF=>{var rWe=require("node:events").EventEmitter,tF=require("node:child_process"),ao=require("node:path"),Sw=require("n...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L13 16Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[t]?this._lifeCycleHooks[t].push(r):this._lifeCycleHooks[t]=[r],this}exitOverride(t){return t?this._exitCallback=t...
L17: - already used by option '${r.flags}'`)}this._initOptionGroup(t),this.options.push(t)}_registerCommand(t){let r=i=>[i.name()].concat(i.aliases()),n=r(t).find(i=>this._findCommand(...
L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,s=>{let a;typeof r=="function"?a=r({error:s.error,command:s.command}):a=r,a&&s.write(`${a}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelp
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L16 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var mHe=Object.create;var mw=Object.defineProperty;var xHe=Object.getOwnPropertyDescriptor;var gHe=Object.getOwnPropertyNames;var vHe=Object.getPrototypeOf,yHe=Object.prototype.has...
`);return s!==-1&&(t=jWe(t,i,n,s)),n+t+i},mF,XZ=(e,...t)=>{let[r]=t;if(!Cw(r)||!Cw(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String(...
`)});var oue=h((VOr,swt)=>{swt.exports={dots:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"]},dots2:{interval:80,fra...
\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOP
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
var mHe=Object.create;var mw=Object.defineProperty;var xHe=Object.getOwnPropertyDescriptor;var gHe=Object.getOwnPropertyNames;var vHe=Object.getPrototypeOf,yHe=Object.prototype.has...
`)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function pZ(e){r...
`)});var oue=h((VOr,swt)=>{swt.exports={dots:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"]},dots2:{interval:80,fra...
\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`a
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg 13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}uZ.suggestSimilar=tWe});var dZ=h(sF=>{var rWe=require("node:events").EventEmitter,tF=require("node:child_process"),ao=require("node:path"),Sw=require("n...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,s=>{let a;typeof r=="function"?a=r({error:s.error,command:s.command}):a=r,a&&s.write(`${a}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function pZ(e){r...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L13 13Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js
L13: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}uZ.suggestSimilar=tWe});var dZ=h(sF=>{var rWe=require("node:events").EventEmitter,tF=require("node:child_process"),ao=require("node:path"),Sw=require("n...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,s=>{let a;typeof r=="function"?a=r({error:s.error,command:s.command}):a=r,a&&s.write(`${a}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.outputH
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L13 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg 1#! /usr/bin/env node
L2: var mHe=Object.create;var mw=Object.defineProperty;var xHe=Object.getOwnPropertyDescriptor;var gHe=Object.getOwnPropertyNames;var vHe=Object.getPrototypeOf,yHe=Object.prototype.has...
L3: `)}displayWidth(t){return aZ(t).length}styleTitle(t){return t}styleUsage(t){return t.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT...
...
L13: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}uZ.suggestSimilar=tWe});var dZ=h(sF=>{var rWe=require("node:events").EventEmitter,tF=require("node:child_process"),ao=require("node:path"),Sw=require("n...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidd
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1