registry / @browserstack/accessibility-devtools / 1.5.0

@browserstack/accessibility-devtools@1.5.0

⚠ Under review

Command-line interface for BrowserStack Accessibility DevTools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 763 KB of source, external domains: browserstack.io

Source & flagged code

6 flagged

index.cjsView file

Lines 1-68javascript

1#!/usr/bin/env node

2const crypto = require("crypto"); try { global.crypto = crypto; } catch (e) {};

3"use strict";var Lc=Object.create;var Gt=Object.defineProperty;var Nc=Object.getOwnPropertyDescriptor;var Tc=Object.getOwnPropertyNames;var Gc=Object.getPrototypeOf,Zc=Object.prototype.hasOwnProperty;var m=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}},kc=(e,t)=>{for(var n in t)Gt(e,n,{get:t[n],enumerable:!0})},Ui=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of Tc(t))!Zc.call(e,i)&&i!==n&&Gt(e,i,{get:()=>t[i],enumerable:!(r=Nc(t,i))||r.enumerable});return e};var L=(e,t,n)=>(n=e!=null?Lc(Gc(e)):{},Ui(t||!e||!e.__esModule?Gt(n,"de ...

5`+e.mark.snippet),r+" "+n):r}function rt(e,t){Error.call(this),this.name="YAMLException",this.reason=e,this.mark=t,this.message=Ki(this,!1),Error.captureStackTrace?Error.captureStackTrace(this,this.constructor):this.stack=new Error().stack||""}rt.prototype=Object.create(Error.prototype);rt.prototype.constructor=rt;rt.prototype.toString=function(t){return this.name+": "+Ki(this,t)};Xi.exports=rt});var zi=m((m0,Pi)=>{"use strict";var it=De();function xn(e,t,n,r,i){var s="",o="",a=Math.floor(i/2)-1;return r-t>a&&(s=" ... ",t=r-a+s.length),n-r>a&&(o=" ...",n=r+a-o.length),{str:s+e.slice(t,n).repla ...

6`+a;for(c=xn(e.buffer,r[o],i[o],e.position,f),a+=it.repeat(" ",t.indent)+Sn((e.line+1).toString(),u)+" | "+c.str+`

7`,a+=it.repeat("-",t.indent+u+3+c.pos)+`^

8`,l=1;l<=t.linesAfter&&!(o+l>=i.length);l++)c=xn(e.buffer,r[o+l],i[o+l],e.position-(r[o]-r[o+l]),f),a+=it.repeat(" ",t.indent)+Sn((e.line+l+1).toString(),u)+" | "+c.str+`

9`;return a.replace(/\n$/,"")}Pi.exports=Vc});var Z=m((I0,Ji)=>{"use strict";var $i=Be(),Uc=["kind","multi","resolve","construct","instanceOf","predicate","represent","representName","defaultStyle","styleAliases"

10\r`;function Ru(e){if(e===null)return!1;var t,n,r=0,i=e.length,s=Wn;for(n=0;n<i;n++)if(t=s.indexOf(e.charAt(n)),!(t>64)){if(t<0)return!1;r+=6}return r%8===0}function Lu(e){var t,n,r=e.replace(/[\r\n=]/g,""),i=r.length,s=Wn,o=0,a=[];for(t=0;t<i;t++)t%4===0&&t&&(a.push(o>>16&255),a.push(o>>8&255),a.push(o&255)),o=o<<6|s.indexOf(r.charAt(t));return n=i%4*6,n===0?(a.push(o>>16&255),a.push(o>>8&255),a.push(o&255)):n===18?(a.push(o>>10&255),a.push(o>>2&255)):n===12&&a.push(o>>4&255),new Uint8Array(a)}function Nu(e){var t="",n=0,r,i,s=e.length,o=Wn;for(r=0;r<s;r++)r%3===0&&r&&(t+=o[n>>18&63],t+=o[n>> ...

11`:e===118?"\v":e===102?"\f":e===114?"\r":e===101?"\x1B":e===32?" ":e===34?'"':e===47?"/":e

12`,t-1))}function rf(e,t,n){var r,i,s,o,a,l,c,u,f=e.kind,d=e.result,h;if(h=e.input.charCodeAt(e.position),B(h)||Fe(h)||h===35||h===38||h===42||h===33||h===124||h===62||h===39||h===34||h===37||h===64||h===96||(h===63||h===45)&&(i=e.input.charCodeAt(e.position+1),B(i)||n&&Fe(i)))return!1;for(e.kind="scalar",e.result="",s=o=e.position,a=!1;h!==0;){if(h===58){if(i=e.input.charCodeAt(e.position+1),B(i)||n&&Fe(i))break}else if(h===35){if(r=e.input.charCodeAt(e.position-1),B(r))break}else{if(e.position===e.lineStart&&Bt(e)||n&&Fe(h))break;if($(h))if(l=e.line,c=e.lineStart,u=e.lineIndent,R(e,!1,-1),e.l ...

13`,s?1+l:l):i===Hn&&s&&(e.result+=`

14`);break}for(r?Ae(f)?(c=!0,e.result+=_e.repeat(`

15`,s?1+l:l)):c?(c=!1,e.result+=_e.repeat(`

16`,l+1)):l===0?s&&(e.result+=" "):e.result+=_e.repeat(`

17`,l):e.result+=_e.repeat(`

18`,s?1+l:l),s=!0,o=!0,l=0,n=e.position;!$(f)&&f!==0;)f=e.input.charCodeAt(++e.position);ue(e,n,e.position,!1)}return!0}function ws(e,t){var n,r

19`),e.charCodeAt(0)===65279&&(e=e.slice(1)));var n=new nf(e,t),r=e.indexOf("\0");for(r!==-1&&(n.position=r,y(n,"null byte is not allowed in input")),n.input+="\0";n.input.charCodeAt(n.position)===32;)n.lineIndent+=1,n.position+=1;for(;n.position<n.length-1;)hf(n);return n.documents}function gf(e,t,n){t!==null&&typeof t=="object"&&typeof n>"u"&&(n=t,t=null);var r=ks(e,n);if(typeof t!="function")return r;for(var i=0,s=r.length;i<s;i+=1)t(r[i])}function pf(e,t){var n=ks(e,t);if(n.length!==0){if(n.length===1)return n[0];throw new Es("expected a single document in the stream, but found more")}}Pn.ex ...

20`,r),i===-1?(o=e.slice(r),r=a):(o=e.slice(r,i+1),r=i+1),o.length&&o!==`

21`&&(s+=n),s+=o;return s}function $n(e,t){return`

22`+Yt.repeat(" ",e.indent*t)}function Ff(e,t){var n,r,i;for(n=0,r=e.implicitTypes.length;n<r;n+=1)if(i=e.implicitTypes[n],i.resolve(t))return!0;return!1}function Wt(e){

23`,i=r&&(e[e.length-2]===`

24`||e===`

25`),s=i?"+":r?"":"-";return n+s+`

26`}function Ys(e){return e[e.length-1]===`

27`?e.slice(0,-1):e}function Uf(e,t){for(var n=/(\n+)([^\n]*)/g,r=(function(){var c=e.indexOf(`

28`);return c=c!==-1?c:e.length,n.lastIndex=c,js(e.slice(0,c),t)})(),i=e[0]===`

29`||e[0]===" ",s,o;o=n.exec(e);){var a=o[1],l=o[2];s=l[0]===" ",r+=a+(!i&&!s&&l!==""?`

30`:"")+js(l,t),i=s}return r}function js(e,t){if(e===""||e[0]===" ")return e;for(var n=/ [^ ]/g,r,i=0,s,o=0,a=0

31`+e.slice(i,s),i=s+1),o=a;return l+=`

32`,e.length-i>t&&o>i?l+=e.slice(i,o)+`

33`+e.slice(o+1):l+=e.slice(i),l.slice(1)}function Hf(e){for(var t="",n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=

34`:""}no.exports.dump=$f});var so=m((B0,D)=>{"use strict";var io=Ms(),Jf=ro();function er(e,t){return function(){throw new Error("Function yaml."+e+" is removed in js-yaml 4. Use yaml."+t+" instead, which is now safe by default.")}}D.exports.Type=Z();D.exports.Schema=vn();D.exports.FAILSAFE_SCHEMA=Nn();D.exports.JSON_SCHEMA=Mn();D.exports.CORE_SCHEMA=Dn();D.exports.DEFAULT_SCHEMA=Zt();D.exports.load=io.load;D.exports.loadAll=io.loadAll;D.exports.dump=Jf.dump;D.exports.YAMLException=Be();D.exports.types={binary:Yn(),float:kn(),map:Ln(),null:Tn(),pairs:Vn(),set:Un(),timestamp:Bn(),bool:Gn(),int:Z ...

35`).join(`\r

36`)),s.removeListener("error",ha),u.setSocket(s,o,{allowSynchronousEvents:this.options.allowSynchronousEvents,maxBufferedChunks:this.options.maxBufferedChunks,maxFragments:this.options.maxFragments,maxPayload:this.options.maxPayload,skipUTF8Validation:this.options.skipUTF8Validation}),this.clients&&(this.clients.add(u),u.on("close",()=>{this.clients.delete(u),this._shouldEmitClose&&!this.clients.size&&process.nextTick(It,this

37`+Object.keys(r).map(i=>`${i}: ${r[i]}`).join(`\r

38`)+`\r

39\r

40`+n)}function ve(e,t,n,r,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ve),e.emit("wsClientError",o,n,t)}else yt(n,r,i,s)}});var Ca=m((oI,ya)=>

41`).replace(/^/gm," ".repeat(s))}let c=[`Usage: ${n.commandUsage(t)}`,""],u=n.commandDescription(t);u.length>0&&(c=c.concat([n.wrap(u,i,0),""]));let f=n.visibleArguments(t).map(g=>a(n.argumentTerm(g),n.argumentDescription(g)));f.length>0&&(c=c.concat(["Arguments:",l(f),""]));let d=n.visibleOptions(t).map(g=>a(n.optionTerm(g),n.optionDescription(g)));if(d.length>0&&(c=c.concat(["Options:",l(d),""])),this.showGlobalOptions){let g=n.visibleGlobalOptions(t).map(p=>a(n.optionTerm(p),n.optionDescription(p)));g.length>0&&(c=c.concat(["Global Options:",l(g),""]))}let h=n.visibleCommands(t).map(g=>a(n.s ...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.cjsView on unpkg · L8

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.cjsView on unpkg · L8

42`)}padWidth(t,n){return Math.max(n.longestOptionTermLength(t,n),n.longestGlobalOptionTermLength(t,n),n.longestSubcommandTermLength(t,n),n.longestArgumentTermLength(t,n))}wrap(t,n,r,i=40){let s=" \\f\\t\\v\xA0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF",o=new RegExp(`[\\n][${s}]+`);if(t.match(o))return t;let a=n-r;if(a<i)return t;let l=t.slice(

43`,`

44`),u=" ".repeat(r),d="\\s\u200B",h=new RegExp(`

45|.{1,${a-1}}([${d}]|$)|[^${d}]+?([${d}]|$)`,"g"),g=c.match(h)||[];return l+g.map((p,I)=>p===`

46`?"":(I>0?u:"")+p.trimEnd()).join(`

47`)}};Ma.Help=Wr});var Hr=m(Ur=>{"use strict";var{InvalidArgumentError:gg}=_t(),jr=class{constructor(t,n){this.flags=t,this.description=n||"",this.required=t.includes("<"),this.optional=

48(Did you mean one of ${r.join(", ")}?)`:r.length===1?`

49(Did you mean ${r[0]}?)`:""}Da.suggestSimilar=yg});var Va=m(ja=>{"use strict";var Cg=require("node:events").EventEmitter,Kr=require("node:child_process"),ae=require("node:path"),Xr=require("node:fs"),O=require("node:process"

50- specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=t._name),(n.noHelp||n.hidden)&&(t._hidden=!0),this._registerCommand(t),t.parent=this,t._checkForBrokenPassThrough(),this}createArgument(t,n){return new bg(t,n)}argument(t,n,r,i){let s=this.createArgument(t,n);return typeof r=="function"?s.default(i).argParser(r):s.default(r),this.addArgument(s),this}arguments(t){return t.trim().split(/ +/).forEach(n=>{this.argument(n)}),this}addArgument(t){let n=this.registeredArguments.slice(-1)[0];if(n&&n.variadic)throw new Error(`only the last ...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.cjsView on unpkg · L33

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.cjsView on unpkg · L33

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.cjsView on unpkg · L33

High

Child Process

Package source references child process execution.

51Expecting one of '${r.join("', '")}'`);return this._lifeCycleHooks[t]?this._lifeCycleHooks[t].push(n):this._lifeCycleHooks[t]=[n],this}exitOverride(t){return t?this._exitCallback=t:this._exitCallback=n=>{if(n.code!=="commander.executeSubCommandAsync")throw n},this}_exit(t,n,r){this._exitCallback&&this._exitCallback(new Pr(t,n,r)),O.exit(t)}action(t){let n=r=>{let i=this.registeredArguments.length,s=r.slice(0,i);return this._storeOptionsAsProperties?s[i]=this:s[i]=this.opts(),s.push(this),t.apply(this,s)};return this._actionHandler=n,this}createOption(t,n){return new Fa(t,n)}_callParseArg(t,n,r ...

52- already used by option '${n.flags}'`)}this.options.push(t)}_registerCommand(t){let n=i=>[i.name()].concat(i.aliases()),r=n(t).find(i=>this._findCommand(i));if(r){let i=n(this._findCommand(r)).join("|"),s=n(t).

53 - if '${t._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

54 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

55 - ${f}`;throw new Error(d)}else if(u.code==="EACCES")throw new Error(`'${o}' not executable`);if(!c)O.exit(1);else{let f=new Pr(1,"commander.executeSubCommandAsync","(error)");f.nestedError=u,c(f)}}),this.runningCommand=l}_dispatchSubcommand(t,n,r){let i=this._findCommand(t);i||this.help({error:!0});let s;return s=this._chainOrCallSubCommandHook(s,i,"preSubcommand"),s=this._chainOrCall(s,()=>{if(i._executableHandler)this._executeSubCommand(i,n.concat(r));else return i._parseCommand(n,r)}),s}_dispatchHelpCommand(t){t||this.help();let n=this._findCommand(t);return n&&!n._executableHandler&&n.he ...

56`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

57`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

58`),this.outputHelp({error:!0}));let r=n||{},i=r.exitCode||1,s=r.code||"commander.error";this._exit(i,s,t)}_parseOptionsEnv(){this.options.forEach(t=>{if(t.envVar&&t.envVar in O.env){let n=t.attributeName();(this.getOptionValue(n)

59`),this._exit(0,"commander.version",t)}),this}description(t,n){return t===void 0&&n===void 0?this._description:(this._description=t,n&&(this._argsDescription=n),this)}summary(t){return t===void 0?this._summary:(this._summary=t,this)}alias(t){if(t===void 0)return this._aliases[0];let n=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler&&(n=this.commands[this.commands.length-1]),t===n._name)throw new Error("Command alias can't be the same as its name");let r=this.parent?._findCommand(t);if(r){let i=[r.name()].concat(r.aliases()).join("|");throw new Error(` ...

60Expecting one of '${r.join("', '")}'`);let i=`${t}Help`;return this.on(i,s=>{let o;typeof n=="function"?o=n({error:s.error,command:s.command}):o=n,o&&s.write(`${o}

61`)}),this}_outputHelpIfRequested(t){let n=this._getHelpOption();n&&t.find(i=>n.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Ya(e){return e.map(t=>{if(!t.startsWith("--inspect"))return t;let n,r="127.0.0.1",i="9229",s;return(s=t.match(/^(--inspect(-brk)?)$/))!==null?n=s[1]:(s=t.match(/^(--inspect(-brk|-port)?)=([^:]+)$/))!==null?(n=s[1],/^\d+$/.test(s[3])?i=s[3]:r=s[3]):(s=t.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/))!==null&&(n=s[1],r=s[3],i=s[4]),n&&i!=="0"?`${n}=${r}:${parseInt(i)+1}`:t})}ja.Command=zr});var Xa=m(V=>{"use strict";var{Ar ...

62`)&&(s=s.slice(12));let o={message:r};return s!==void 0&&(o.suggestion=s),o}}catch{}return{message:e}}function Xm(e){let t=ac(e.severity,e.deva11ySeverity);if(t===null)return null;let{message:n,suggestion:r}=lc(e.message),i=e.ruleId

63`:`

64`)+n,i=r+1,r=e.indexOf(`

65`,i)}while(r!==-1);return s+=e.slice(i),s}var{stdout:La,stderr:Na}=va,Rr=Symbol("GENERATOR"),Je=Symbol("STYLER"),Ct=Symbol("IS_EMPTY"),Ta=["ansi","ansi","ansi256","ansi16m"],qe=Object.create(null),eg=(e,t={})=>{if(t.level&&!(Number.isInteger(t.level)&&t.level>=0&&t.level<=3))throw new Error("The `level` option should be an integer from 0 to 3");let n=La?La.level:0;e.level=t.level===void 0?n:t.level};var tg=e=>{let t=(...n)=>n.join(" ");return eg(t,e),Object.setPrototypeOf(t,bt.prototype),t};function bt(e){return tg(e)}Object.setPrototypeOf(bt.prototype,Function.prototype);for(let[e,t]of Object ...

66`);return s!==-1&&(t=Ra(t,i,r,s)),r+t+i};Object.defineProperties(bt.prototype,qe);var sg=bt(),mI=bt({level:Na?Na.level:0});var b=sg;var ke=L(require("fs/promises")),Nt=require("node:perf_hooks"),Q=L(

67`):[],l=s.aggregated_results.map(c=>({...c,rule_issues:c.rule_issues.map(u=>{if(!o)return u;let f=u.location.start.line;if(typeof f!="number")return u;let d=u.location.end?.line??f,h=ug(a,f,d);return h?{...u,code_context:h}:u})}));return{...s,aggregated_results:l}}),i={...e,data:r,__enriched:!0};return t&&(i.run_metadata=t),i}var Pa=L(Xa(),1),{program:vI,createCommand:OI,createArgument:RI,createOption:LI,CommanderError:NI,InvalidArgumentError:TI,InvalidOptionArgumentError:GI,Command:za,Argument:ZI,Option:Jr,Help:kI}=Pa.default;var ii=L(ol());function si(e=process.argv){let t=new za;t.option("- ...

68 <meta charset="utf-8">

Long lines were clipped for display.

Source & flagged code

6 flagged · loading source

index.cjsView file

8`,l=1;l<=t.linesAfter&&!(o+l>=i.length);l++)c=xn(e.buffer,r[o+l],i[o+l],e.position-(r[o]-r[o+l]),f),a+=it.repeat(" ",t.indent)+Sn((e.line+l+1).toString(),u)+" | "+c.str+` L9: `;return a.replace(/\n$/,"")}Pi.exports=Vc});var Z=m((I0,Ji)=>{"use strict";var $i=Be(),Uc=["kind","multi","resolve","construct","instanceOf","predicate","represent","representName... L10: \r`;function Ru(e){if(e===null)return!1;var t,n,r=0,i=e.length,s=Wn;for(n=0;n<i;n++)if(t=s.indexOf(e.charAt(n)),!(t>64)){if(t<0)return!1;r+=6}return r%8===0}function Lu(e){var t,n,... ... L33: `+e.slice(o+1):l+=e.slice(i),l.slice(1)}function Hf(e){for(var t="",n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=ot(e,i),r=k[n],!r&&ct(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||Mf(n);re... L34: `:""}no.exports.dump=$f});var so=m((B0,D)=>{"use strict";var io=Ms(),Jf=ro();function er(e,t){return function(){throw new Error("Function yaml."+e+" is removed in js-yaml 4. Use ya... L35: `).join(`\r ... L39: \r L40: `+n)}function ve(e,t,n,r,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ve),e.emit("wsClientError",o,n,t)}else yt(n,r,i,s)}});var Ca=m((oI,y... L41: `).replace(/^/gm," ".repeat(s))}let c=[`Usa

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.cjsView on unpkg · L8

33Trigger-reachable chain: manifest.main -> index.cjs L33: `+e.slice(o+1):l+=e.slice(i),l.slice(1)}function Hf(e){for(var t="",n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=ot(e,i),r=k[n],!r&&ct(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||Mf(n);re... L34: `:""}no.exports.dump=$f});var so=m((B0,D)=>{"use strict";var io=Ms(),Jf=ro();function er(e,t){return function(){throw new Error("Function yaml."+e+" is removed in js-yaml 4. Use ya... L35: `).join(`\r ... L39: \r L40: `+n)}function ve(e,t,n,r,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ve),e.emit("wsClientError",o,n,t)}else yt(n,r,i,s)}});var Ca=m((oI,y... L41: `).replace(/^/gm," ".repeat(s))}let c=[`Usage: ${n.commandUsage(t)}`,""],u=n.commandDescription(t);u.length>0&&(c=c.concat([n.wrap(u,i,0),""]));let f=n.visibleArguments(t).map(g=>a... ... L48: (Did you mean one of ${r.join(", ")}?)`:r.length===1?` L49: (Did you mean ${r[0]}?)`:""}Da.suggestSimilar=yg});var Va=m(ja=>{"use strict";var Cg=require("node:events").EventEmitter,Kr=require("node:child_process"),ae=require("node:path"),Xr... L50: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultC…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.cjsView on unpkg · L33

48(Did you mean one of ${r.join(", ")}?)`:r.length===1?` L49: (Did you mean ${r[0]}?)`:""}Da.suggestSimilar=yg});var Va=m(ja=>{"use strict";var Cg=require("node:events").EventEmitter,Kr=require("node:child_process"),ae=require("node:path"),Xr... L50: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=t._name),(n.noHelp||n.hidden)&&(t._hidden=!0),this._registerComma...

High

Child Process

Package source references child process execution.

index.cjsView on unpkg · L48

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.cjsView on unpkg · L33

33`+e.slice(o+1):l+=e.slice(i),l.slice(1)}function Hf(e){for(var t="",n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=ot(e,i),r=k[n],!r&&ct(n)?(t+=e[i],n>=65536&&(t+=e[i+1])):t+=r||Mf(n);re... L34: `:""}no.exports.dump=$f});var so=m((B0,D)=>{"use strict";var io=Ms(),Jf=ro();function er(e,t){return function(){throw new Error("Function yaml."+e+" is removed in js-yaml 4. Use ya... L35: `).join(`\r ... L39: \r L40: `+n)}function ve(e,t,n,r,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ve),e.emit("wsClientError",o,n,t)}else yt(n,r,i,s)}});var Ca=m((oI,y... L41: `).replace(/^/gm," ".repeat(s))}let c=[`Usage: ${n.commandUsage(t)}`,""],u=n.commandDescription(t);u.length>0&&(c=c.concat([n.wrap(u,i,0),""]));let f=n.visibleArguments(t).map(g=>a... ... L48: (Did you mean one of ${r.join(", ")}?)`:r.length===1?` L49: (Did you mean ${r[0]}?)`:""}Da.suggestSimilar=yg});var Va=m(ja=>{"use strict";var Cg=require("node:events").EventEmitter,Kr=require("node:child_process"),ae=require("node:path"),Xr... L50: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=t._name),(n.noHelp||n.hidden)&&(t._hidden=

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.cjsView on unpkg · L33

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.cjsView on unpkg · L8

Findings

2 Critical4 High3 Medium6 Low

CriticalRemote Asset Decode Executeindex.cjs

CriticalTrigger Reachable Dangerous Capabilityindex.cjs

HighChild Processindex.cjs

HighShell

HighSame File Env Network Executionindex.cjs

HighCommand Output Exfiltrationindex.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowWeak Cryptoindex.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

index.cjsView file

Lines 1-68javascript

1#!/usr/bin/env node

2const crypto = require("crypto"); try { global.crypto = crypto; } catch (e) {};

6`+a;for(c=xn(e.buffer,r[o],i[o],e.position,f),a+=it.repeat(" ",t.indent)+Sn((e.line+1).toString(),u)+" | "+c.str+`

7`,a+=it.repeat("-",t.indent+u+3+c.pos)+`^

8`,l=1;l<=t.linesAfter&&!(o+l>=i.length);l++)c=xn(e.buffer,r[o+l],i[o+l],e.position-(r[o]-r[o+l]),f),a+=it.repeat(" ",t.indent)+Sn((e.line+l+1).toString(),u)+" | "+c.str+`

11`:e===118?"\v":e===102?"\f":e===114?"\r":e===101?"\x1B":e===32?" ":e===34?'"':e===47?"/":e

13`,s?1+l:l):i===Hn&&s&&(e.result+=`

14`);break}for(r?Ae(f)?(c=!0,e.result+=_e.repeat(`

15`,s?1+l:l)):c?(c=!1,e.result+=_e.repeat(`

16`,l+1)):l===0?s&&(e.result+=" "):e.result+=_e.repeat(`

17`,l):e.result+=_e.repeat(`

18`,s?1+l:l),s=!0,o=!0,l=0,n=e.position;!$(f)&&f!==0;)f=e.input.charCodeAt(++e.position);ue(e,n,e.position,!1)}return!0}function ws(e,t){var n,r

20`,r),i===-1?(o=e.slice(r),r=a):(o=e.slice(r,i+1),r=i+1),o.length&&o!==`

21`&&(s+=n),s+=o;return s}function $n(e,t){return`

22`+Yt.repeat(" ",e.indent*t)}function Ff(e,t){var n,r,i;for(n=0,r=e.implicitTypes.length;n<r;n+=1)if(i=e.implicitTypes[n],i.resolve(t))return!0;return!1}function Wt(e){

23`,i=r&&(e[e.length-2]===`

24`||e===`

25`),s=i?"+":r?"":"-";return n+s+`

26`}function Ys(e){return e[e.length-1]===`

27`?e.slice(0,-1):e}function Uf(e,t){for(var n=/(\n+)([^\n]*)/g,r=(function(){var c=e.indexOf(`

28`);return c=c!==-1?c:e.length,n.lastIndex=c,js(e.slice(0,c),t)})(),i=e[0]===`

29`||e[0]===" ",s,o;o=n.exec(e);){var a=o[1],l=o[2];s=l[0]===" ",r+=a+(!i&&!s&&l!==""?`

30`:"")+js(l,t),i=s}return r}function js(e,t){if(e===""||e[0]===" ")return e;for(var n=/ [^ ]/g,r,i=0,s,o=0,a=0

31`+e.slice(i,s),i=s+1),o=a;return l+=`

32`,e.length-i>t&&o>i?l+=e.slice(i,o)+`

33`+e.slice(o+1):l+=e.slice(i),l.slice(1)}function Hf(e){for(var t="",n=0,r,i=0;i<e.length;n>=65536?i+=2:i++)n=

35`).join(`\r

37`+Object.keys(r).map(i=>`${i}: ${r[i]}`).join(`\r

38`)+`\r

39\r

40`+n)}function ve(e,t,n,r,i,s){if(e.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ve),e.emit("wsClientError",o,n,t)}else yt(n,r,i,s)}});var Ca=m((oI,ya)=>

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.cjsView on unpkg · L8

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.cjsView on unpkg · L8

43`,`

44`),u=" ".repeat(r),d="\\s\u200B",h=new RegExp(`

45|.{1,${a-1}}([${d}]|$)|[^${d}]+?([${d}]|$)`,"g"),g=c.match(h)||[];return l+g.map((p,I)=>p===`

46`?"":(I>0?u:"")+p.trimEnd()).join(`

47`)}};Ma.Help=Wr});var Hr=m(Ur=>{"use strict";var{InvalidArgumentError:gg}=_t(),jr=class{constructor(t,n){this.flags=t,this.description=n||"",this.required=t.includes("<"),this.optional=

48(Did you mean one of ${r.join(", ")}?)`:r.length===1?`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.cjsView on unpkg · L33

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.cjsView on unpkg · L33

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.cjsView on unpkg · L33

High

Child Process

Package source references child process execution.

53 - if '${t._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

54 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

56`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

57`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

60Expecting one of '${r.join("', '")}'`);let i=`${t}Help`;return this.on(i,s=>{let o;typeof n=="function"?o=n({error:s.error,command:s.command}):o=n,o&&s.write(`${o}

63`:`

64`)+n,i=r+1,r=e.indexOf(`

68 <meta charset="utf-8">

Long lines were clipped for display.