463patternName = private_key_rsa
severity = critical
line = 463
matchedText = `||Y==="...thm.
CriticalCritical Secret
Package contains a critical-looking secret pattern.
dist/src/sdk.jsView on unpkg · L463 4`){if(Y)X+=K_("");let z=Q?O_(Q):void 0;if(Q&&z)X+=V_(z)}else if(H===`
L5: `){if(Q&&O_(Q))X+=V_(Q);if(Y)X+=K_(Y)}}return X},tV0;var PN=s(()=>{IN();TN=`${pV0}8;;`,z_=new RegExp(`(?:\\${w_}(?<code>\\d+)m|\\${TN}(?<uri>.*)${CN})`,"y"),tV0=/\r?\n/});var U1=R(...
L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y]....
L7: `),X=D.split(`
L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function W$($){return $==...
L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(`
...
L14: `).slice(Y);this.output.wr
CriticalRemote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/src/sdk.jsView on unpkg · L4 131Trigger-reachable chain: manifest.exports -> dist/src/sdk.js
L131: `)}function $x0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function Dx0(){return process.env.DEBUG}function Jx0($){$.inspectOpts={};let D=Object.keys(ld.inspectOpts)...
L132: `).map((D)=>D.trim()).join(" ")};cd.O=function($){return this.inspectOpts.colors=this.useColors,a3.inspect($,this.inspectOpts)}});var e3=R((CM$,GL)=>{if(typeof process>"u"||process...
L133:
L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath...
L135:
L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/src/sdk.jsView on unpkg · L131 463patternName = private_key_rsa
severity = critical
line = 463
matchedText = `||Y==="...thm.
472patternName = private_key_rsa
severity = critical
line = 472
matchedText = `+" - T...in(`
650patternName = private_key_rsa
severity = critical
line = 650
matchedText = All pack... Y=`
273L274: see https://github.com/jprichardson/node-fs-extra/issues/269`);PF.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;PF.checkParentPaths($,Z,D,"copy",(U)=>{...
L275: `)}Q60.check=Ki0;async function Ni0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...
311export default config;
L312: `}});var hH,p9,gE,E60,R60,A60,I60,j60;var mE=s(()=>{hH=E$(B60(),1),p9=E$(XH(),1),gE=hH.loadConfig,E60=hH.writeConfig,R60=p9.findMonorepoRoot,A60=p9.findNXMonorepoRoot,I60=p9.isMono...
L313: `)}var k60=($,D)=>{$.name="$ZodError",Object.defineProperty($,"_zod",{value:$._zod,enumerable:!1}),Object.defineProperty($,"issues",{value:D,enumerable:!1}),$.message=JSON.stringif...
133L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath...
L135:
L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J);if($F.checkParentPathsSync($,...
L137: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r...
L138: `)];for(let[G,q]of U.entries()){if(X+=q,GW.has(q)){let{groups:H}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(H.code!==void 0)...
...
L146: `);return W=Math
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/sdk.jsView on unpkg · L133 131`)}function $x0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function Dx0(){return process.env.DEBUG}function Jx0($){$.inspectOpts={};let D=Object.keys(ld.inspectOpts)...
L132: `).map((D)=>D.trim()).join(" ")};cd.O=function($){return this.inspectOpts.colors=this.useColors,a3.inspect($,this.inspectOpts)}});var e3=R((CM$,GL)=>{if(typeof process>"u"||process...
L133:
L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath...
L135:
L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J);if($F.checkParentPathsSync($,...
L137: `,finalEOL:J=!0,repl
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/src/sdk.jsView on unpkg · L131 125`)}),D}});var km=R((bw$,_m)=>{var I9=a("constants"),GP0=process.cwd,_3=null,qP0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!_3)_3=GP0.call(process...
L126: GFS4: `),console.error($)};if(!A1[GD]){if(gM=global[GD]||[],mm(A1,gM),A1.close=function($){function D(J,X){return $.call(A1,J,function(Q){if(!Q)gm();if(typeof X==="function")X.appl...
L127: `)}}});var OX=s(()=>{xd()});async function r3($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...
HighObfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/src/sdk.jsView on unpkg · L125 108${L}`}});var qy=R((Uy)=>{Object.defineProperty(Uy,"__esModule",{value:!0});Uy.WebAuthnUnknownError=Uy.WebAuthnError=void 0;Uy.isWebAuthnError=bB0;Uy.identifyRegistrationError=gB0;U...
L109: `);let M=await K.signMessage(new TextEncoder().encode(z),"utf8");if(!M||!(M instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v...
L110: `)!=-1,X=this._styles,Q=X.length;while(Q--){var Y=d7[X[Q]];if(D=Y.open+D.replace(Y.closeRe,Y.open)+Y.close,J)D=D.replace(b20,function(Z){return Y.close+Z+Y.open})}return D}K$.setTh...
MediumDynamic Require
Package source references dynamic require/import behavior.
dist/src/sdk.jsView on unpkg · L108 4`){if(Y)X+=K_("");let z=Q?O_(Q):void 0;if(Q&&z)X+=V_(z)}else if(H===`
L5: `){if(Q&&O_(Q))X+=V_(Q);if(Y)X+=K_(Y)}}return X},tV0;var PN=s(()=>{IN();TN=`${pV0}8;;`,z_=new RegExp(`(?:\\${w_}(?<code>\\d+)m|\\${TN}(?<uri>.*)${CN})`,"y"),tV0=/\r?\n/});var U1=R(...
L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y]....
L7: `),X=D.split(`
L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function W$($){return $==...
L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(`
...
L14: `).slice(Y);this.output.wr
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/src/sdk.jsView on unpkg · L4