13${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=r??{};return this._client.get(X`/v1/deployment_runs/${t}?beta=t...
L15: `);return t[t.length-1]===""&&t.pop(),t}function o7(e,t){return/^[\x20-\x7E]+$/.test(t)&&!/[\\^#]/.test(t)&&!(e==="unzip"&&t.startsWith("-"))}function A7(e,t,r){let n=F2(t),i=F2(r)...
5`);let n;for(;(n=_K.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
L7: `):[]}};Si=new WeakMap,xi=new WeakMap;Ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=r??{};return this._client.get(X`/v1/deployment_runs/${t}?beta=t...
L15: `);return t[t.length-1]===""&&t.pop(),t}function o7(e,t){return/^[\x20-\x7E]+$/.test(t)&&!/[\\^#]/.test(t)&&!(e==="unzip"&&t.startsWith("-"))}function A7(e,t,r){let n=F2(t),i=
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.mjsView on unpkg · L5 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.mjs:
`),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=r??{};return this._client.get(X`/v1/deployment_runs/${t}?beta=t...
`);return t[t.length-1]===""&&t.pop(),t}function o7(e,t){return/^[\x20-\x7E]+$/.test(t)&&!/[\\^#]/.test(t)&&!(e==="unzip"&&t.startsWith("-"))}function A7(e,t,r){let n=F2(t),i=F2(r)...
`,{flag:"wx",mode:384}),["-xf",t,"-C",r,"-X",i])}async function u7(e,t){let r
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.mjsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli.mjs:
`),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
`,"\r"]);Ja.NEWLINE_REGEXP=/\r\n|[\n\r]/g});async function*O1(e,t){if(!e.body)throw t.abort(),typeof globalThis.navigator<"u"&&globalThis.navigator.product==="ReactNative"?new ne("...
${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=r??{};return this._client.get(X`/v1/deployment_runs/${t}?beta=t...
`);return t[t.length-1]===""&&t.pop(),t}function o7(e,t){return/^[\x20-\x7E]+$/.test(t)&&!/[\\^#]/
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli.mjsView on unpkg 3const require = __bcodeCreateRequire(import.meta.url);
L4: var EK=Object.create;var T0=Object.defineProperty;var mK=Object.getOwnPropertyDescriptor;var CK=Object.getOwnPropertyNames;var BK=Object.getPrototypeOf,IK=Object.prototype.hasOwnPr...
L5: `);let n;for(;(n=_K.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
L7: `):[]}};Si=new WeakMap,xi=new WeakMap;Ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.mjsView on unpkg · L3 5`);let n;for(;(n=_K.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
L7: `):[]}};Si=new WeakMap,xi=new WeakMap;Ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=r??{};return this._client.get(X`/v1/deployment_runs/${t}?beta=t...
L15: `);return t[t.length-1]===""&&t.pop(),t}function o7(e,t){return/^[\x20-\x7E]+$/.test(t)&&!/[\\^#]/.test(t)&&!(e==="unzip"&&t.startsWith("-"))}function A7(e,t,r){let n=F2(t),i=
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/cli.mjsView on unpkg · L5 3Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs
L3: const require = __bcodeCreateRequire(import.meta.url);
L4: var EK=Object.create;var T0=Object.defineProperty;var mK=Object.getOwnPropertyDescriptor;var CK=Object.getOwnPropertyNames;var BK=Object.getPrototypeOf,IK=Object.prototype.hasOwnPr...
L5: `);let n;for(;(n=_K.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
L7: `):[]}};Si=new WeakMap,xi=new WeakMap;Ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/cli.mjsView on unpkg · L3 2import { createRequire as __bcodeCreateRequire } from 'node:module';
L3: const require = __bcodeCreateRequire(import.meta.url);
L4: var EK=Object.create;var T0=Object.defineProperty;var mK=Object.getOwnPropertyDescriptor;var CK=Object.getOwnPropertyNames;var BK=Object.getPrototypeOf,IK=Object.prototype.hasOwnPr...
MediumDynamic Require
Package source references dynamic require/import behavior.
dist/cli.mjsView on unpkg · L2 3const require = __bcodeCreateRequire(import.meta.url);
L4: var EK=Object.create;var T0=Object.defineProperty;var mK=Object.getOwnPropertyDescriptor;var CK=Object.getOwnPropertyNames;var BK=Object.getPrototypeOf,IK=Object.prototype.hasOwnPr...
L5: `);let n;for(;(n=_K.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),t[i]=s}return t}function xK(e){e=e||{};let t=GN(e);e.path=t;let r=jr.configDotenv(e);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${t} for...
L7: `):[]}};Si=new WeakMap,xi=new WeakMap;Ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${C}`)}return A},X=Cj(e2)});var mu,gw=$(()=>{Bt();vt();nt();Gt();mu=class extends Qe{retrieve(t,r={},n){let{betas:i}=
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/cli.mjsView on unpkg · L3