78\v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u...
L79: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uF...
L80: `;ue.DEFAULT_CONTENT_TYPE="application/octet-stream";ue.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=v6.prototype.append.bind(this);if((typeo...
...
L90: `;let d=rCe.default(a);a.write(`${c}\r
L91: `);let{statusCode:m,buffered:h}=yield d;if(m===200){if(t.once("socket",nCe),r.secureEndpoint){dl("Upgrading socket connection to TLS");let b=r.servername||r.host;return gL.default.
CriticalAi Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
dist/index.jsView on unpkg · L78 13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}KO.suggestSimilar=xJ});var QO=f(Ib=>{var vJ=require("node:events").EventEmitter,Fb=require("node:child_process"),Fn=require("node:path"),Dp=require("nod...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L13 16Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[t]?this._lifeCycleHooks[t].push(r):this._lifeCycleHooks[t]=[r],this}exitOverride(t){return t?this._exitCallback=t...
L17: - already used by option '${r.flags}'`)}this._initOptionGroup(t),this.options.push(t)}_registerCommand(t){let r=i=>[i.name()].concat(i.aliases()),n=r(t).find(i=>this._findCommand(...
L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,a=>{let s;typeof r=="function"?s=r({error:a.error,command:a.command}):s=r,s&&a.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelp
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L16 •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
`)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ZO(e){r...
`)});var VF=f((aYe,v4e)=>{v4e.exports={dots:{interval:80,frames:["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"]},dots2:{interval:80,fram...
\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uF...
`);let{statusCode:m,buffered:h}=yield d;if(m===200){if(t.once("socket",nCe),r.secureEndpoint){dl(
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg 13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}KO.suggestSimilar=xJ});var QO=f(Ib=>{var vJ=require("node:events").EventEmitter,Fb=require("node:child_process"),Fn=require("node:path"),Dp=require("nod...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,a=>{let s;typeof r=="function"?s=r({error:a.error,command:a.command}):s=r,s&&a.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ZO(e){r...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L13 13Trigger-reachable command-output exfiltration chain: scripts.postinstall -> dist/index.js
L13: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}KO.suggestSimilar=xJ});var QO=f(Ib=>{var vJ=require("node:events").EventEmitter,Fb=require("node:child_process"),Fn=require("node:path"),Dp=require("nod...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=t._name),(r.noHelp||r.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${t}Help`;return this.on(i,a=>{let s;typeof r=="function"?s=r({error:a.error,command:a.command}):s=r,s&&a.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let r=this._getHelpOption();r&&t.find(i=>r.is(i))&&(this.o
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L13 129`;Br.escapeXML=function(e){return e==null?"":String(e).replace(KNe,XNe)};function $X(){return Function.prototype.toString.call(this)+`;
L130: `+YNe}try{typeof Object.defineProperty=="function"?Object.defineProperty(Br.escapeXML,"toString",{value:$X}):Br.escapeXML.toString=$X}catch{console.warn("Unable to set escapeXML.to...
L131: `),s=Math.max(n-3,0),o=Math.min(a.length,n+3),c=i(r),u=a.slice(s,o).map(function(l,p){var d=p+s+1;return(d==n?" >> ":" ")+d+"| "+l}).join(`
LowEval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L129