@capgo/cli@8.28.2: Suspicious npm security report (Warn)

Loading npm security reports…

@capgo/cli@8.28.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

4`){if(Y)X+=I_("");let H=Q?R_(Q):void 0;if(Q&&H)X+=A_(H)}else if(z===` L5: `){if(Q&&R_(Q))X+=A_(Q);if(Y)X+=I_(Y)}}return X},GK0;var kN=s(()=>{SN();_N=`${ZK0}8;;`,E_=new RegExp(`(?:\\${C_}(?<code>\\d+)m|\\${_N}(?<uri>.*)${vN})`,"y"),GK0=/\r?\n/});var z1=A(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function H$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

131Trigger-reachable chain: manifest.exports -> dist/src/sdk.js L131: `)}function Hx0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function Ox0(){return process.env.DEBUG}function Vx0($){$.inspectOpts={};let D=Object.keys(ed.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};sd.O=function($){return this.inspectOpts.colors=this.useColors,$W.inspect($,this.inspectOpts)}});var JW=A((QL$,OL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await eZ.checkPaths($,D,"copy",J);if(await eZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=DF.checkPathsSync($,D,"copy",J

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/sdk.jsView on unpkg · L131

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L463

472patternName = private_key_rsa severity = critical line = 472 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L472

661patternName = private_key_rsa severity = critical line = 661 matchedText = All pack... Y=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L661

273L274: see https://github.com/jprichardson/node-fs-extra/issues/269`);xF.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;xF.checkParentPaths($,Z,D,"copy",(U)=>{... L275: `)}H60.check=Pi0;async function Si0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L273

311export default config; L312: `}});var gz,r9,x60,v60,_60,k60,u60,y60,f60,h60;var nE=s(()=>{gz=R$(S60(),1),r9=R$(Yz(),1),x60=R$(BF(),1),v60=x60.requireTS,_60=gz.loadConfig,k60=gz.writeConfig,u60=r9.findMonorepoR... L313: `)}var o60=($,D)=>{$.name="$ZodError",Object.defineProperty($,"_zod",{value:$._zod,enumerable:!1}),Object.defineProperty($,"issues",{value:D,enumerable:!1}),$.message=JSON.stringif...

High

Eval

Package source references dynamic code evaluation.

dist/src/sdk.jsView on unpkg · L311

133L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await eZ.checkPaths($,D,"copy",J);if(await eZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=DF.checkPathsSync($,D,"copy",J);if(DF.checkParentPathsSync($,... L137: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r... L138: `)];for(let[G,q]of U.entries()){if(X+=q,zW.has(q)){let{groups:z}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(z.code!==void 0)... ... L146: `);return W=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L133

131`)}function Hx0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function Ox0(){return process.env.DEBUG}function Vx0($){$.inspectOpts={};let D=Object.keys(ed.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};sd.O=function($){return this.inspectOpts.colors=this.useColors,$W.inspect($,this.inspectOpts)}});var JW=A((QL$,OL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await eZ.checkPaths($,D,"copy",J);if(await eZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=DF.checkPathsSync($,D,"copy",J);if(DF.checkParentPathsSync($,... L137: `,finalEOL:J=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L131

125`)}),D}});var cm=A((KM$,dm)=>{var j9=a("constants"),EP0=process.cwd,y3=null,RP0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!y3)y3=EP0.call(process... L126: GFS4: `),console.error($)};if(!C1[WD]){if(nM=global[WD]||[],tm(C1,nM),C1.close=function($){function D(J,X){return $.call(C1,J,function(Q){if(!Q)om();if(typeof X==="function")X.appl... L127: `)}}});var NX=s(()=>{gd()});async function a3($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L125

108${L}`}});var wf=A((Kf)=>{Object.defineProperty(Kf,"__esModule",{value:!0});Kf.WebAuthnUnknownError=Kf.WebAuthnError=void 0;Kf.isWebAuthnError=sB0;Kf.identifyRegistrationError=eB0;K... L109: `);let M=await K.signMessage(new TextEncoder().encode(H),"utf8");if(!M||!(M instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v... L110: `)!=-1,X=this._styles,Q=X.length;while(Q--){var Y=l7[X[Q]];if(D=Y.open+D.replace(Y.closeRe,Y.open)+Y.close,J)D=D.replace(s20,function(Z){return Y.close+Z+Y.open})}return D}w$.setTh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L108

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4540645 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4540645 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/sdk.jsView on unpkg · L131

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L463

472patternName = private_key_rsa severity = critical line = 472 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L472

661patternName = private_key_rsa severity = critical line = 661 matchedText = All pack... Y=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L661

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L273

High

Eval

Package source references dynamic code evaluation.

dist/src/sdk.jsView on unpkg · L311

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L133

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L131

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L125

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L108

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4540645 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4540645 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

15 flagged

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/sdk.jsView on unpkg · L131

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L463

472patternName = private_key_rsa severity = critical line = 472 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L472

661patternName = private_key_rsa severity = critical line = 661 matchedText = All pack... Y=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L661

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L273

High

Eval

Package source references dynamic code evaluation.

dist/src/sdk.jsView on unpkg · L311

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L133

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L131

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L125

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L108

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4540645 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4540645 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

@capgo/cli@8.28.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code