@capgo/cli@8.32.7: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@capgo/cli@8.32.7: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

16 flagged · loading source

dist/src/sdk.jsView file

4`){if(Y)X+=vk("");let H=Q?Sk(Q):void 0;if(Q&&H)X+=xk(H)}else if(z===` L5: `){if(Q&&Sk(Q))X+=xk(Q);if(Y)X+=vk(Y)}}return X},pM0;var TM=t(()=>{RM();jM=`${lM0}8;;`,Pk=new RegExp(`(?:\\${kk}(?<code>\\d+)m|\\${jM}(?<uri>.*)${IM})`,"y"),pM0=/\r?\n/});var O1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function M$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @capgo/cli@8.33.0 matchedIdentity = npm:QGNhcGdvL2NsaQ:8.33.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

259L260: see https://github.com/jprichardson/node-fs-extra/issues/269`);QU.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;QU.checkParentPaths($,Z,D,"copy",(U)=>{... L261: `)}x40.check=Io0;async function jo0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L259

119L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await jF.checkPaths($,D,"copy",J);if(await jF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=CF.checkPathsSync($,D,"copy",J);if(CF.checkParentPathsSync($,... L123: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r... L124: `)];for(let[G,q]of U.entries()){if(X+=q,oW.has(q)){let{groups:z}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(z.code!==void 0)... ... L132: `);return W=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L119

117`)}function Gk0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function qk0(){return process.env.DEBUG}function Wk0($){$.inspectOpts={};let D=Object.keys(Nl.inspectOpts)... L118: `).map((D)=>D.trim()).join(" ")};Kl.O=function($){return this.inspectOpts.colors=this.useColors,fW.inspect($,this.inspectOpts)}});var bW=R((PR$,GB)=>{if(typeof process>"u"||process... L119: L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await jF.checkPaths($,D,"copy",J);if(await jF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=CF.checkPathsSync($,D,"copy",J);if(CF.checkParentPathsSync($,... L123: `,finalEOL:J=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L117

111`)}),D}});var Yc=R((hE$,Qc)=>{var n9=e("constants"),Nv0=process.cwd,MW=null,Mv0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!MW)MW=Nv0.call(process... L112: GFS4: `),console.error($)};if(!P1[OD]){if(hL=global[OD]||[],zc(P1,hL),P1.close=function($){function D(J,X){return $.call(P1,J,function(Q){if(!Q)Wc();if(typeof X==="function")X.appl... L113: `)}}});var dX=t(()=>{Ql()});async function kW($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L111

4`){if(Y)X+=vk("");let H=Q?Sk(Q):void 0;if(Q&&H)X+=xk(H)}else if(z===` L5: `){if(Q&&Sk(Q))X+=xk(Q);if(Y)X+=vk(Y)}}return X},pM0;var TM=t(()=>{RM();jM=`${lM0}8;;`,Pk=new RegExp(`(?:\\${kk}(?<code>\\d+)m|\\${jM}(?<uri>.*)${IM})`,"y"),pM0=/\r?\n/});var O1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function M$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

5`){if(Y)$+=MMA("");let q=J?CMA(J):void 0;if(J&&q)$+=OMA(q)}else if(U===` L6: `){if(J&&CMA(J))$+=OMA(J);if(Y)$+=MMA(Y)}}return $},jKQ;var mBA=uA(()=>{yBA();uBA=`${VKQ}8;;`,IMA=new RegExp(`(?:\\${NMA}(?<code>\\d+)m|\\${uBA}(?<uri>.*)${hBA})`,"y"),jKQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function k1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1649contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${tDA} in the Cap-go org.`).action(Q9Q);F$.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1649

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=MMA("");let q=J?CMA(J):void 0;if(J&&q)$+=OMA(q)}else if(U===` L6: `){if(J&&CMA(J))$+=OMA(J);if(Y)$+=MMA(Y)}}return $},jKQ;var mBA=uA(()=>{yBA();uBA=`${VKQ}8;;`,IMA=new RegExp(`(?:\\${NMA}(?<code>\\d+)m|\\${uBA}(?<uri>.*)${hBA})`,"y"),jKQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function k1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$

Source & flagged code

16 flagged

dist/src/sdk.jsView file

4`){if(Y)X+=vk("");let H=Q?Sk(Q):void 0;if(Q&&H)X+=xk(H)}else if(z===` L5: `){if(Q&&Sk(Q))X+=xk(Q);if(Y)X+=vk(Y)}}return X},pM0;var TM=t(()=>{RM();jM=`${lM0}8;;`,Pk=new RegExp(`(?:\\${kk}(?<code>\\d+)m|\\${jM}(?<uri>.*)${IM})`,"y"),pM0=/\r?\n/});var O1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function M$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @capgo/cli@8.33.0 matchedIdentity = npm:QGNhcGdvL2NsaQ:8.33.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

259L260: see https://github.com/jprichardson/node-fs-extra/issues/269`);QU.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;QU.checkParentPaths($,Z,D,"copy",(U)=>{... L261: `)}x40.check=Io0;async function jo0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L259

119L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await jF.checkPaths($,D,"copy",J);if(await jF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=CF.checkPathsSync($,D,"copy",J);if(CF.checkParentPathsSync($,... L123: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r... L124: `)];for(let[G,q]of U.entries()){if(X+=q,oW.has(q)){let{groups:z}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(z.code!==void 0)... ... L132: `);return W=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L119

117`)}function Gk0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function qk0(){return process.env.DEBUG}function Wk0($){$.inspectOpts={};let D=Object.keys(Nl.inspectOpts)... L118: `).map((D)=>D.trim()).join(" ")};Kl.O=function($){return this.inspectOpts.colors=this.useColors,fW.inspect($,this.inspectOpts)}});var bW=R((PR$,GB)=>{if(typeof process>"u"||process... L119: L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await jF.checkPaths($,D,"copy",J);if(await jF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=CF.checkPathsSync($,D,"copy",J);if(CF.checkParentPathsSync($,... L123: `,finalEOL:J=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L117

111`)}),D}});var Yc=R((hE$,Qc)=>{var n9=e("constants"),Nv0=process.cwd,MW=null,Mv0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!MW)MW=Nv0.call(process... L112: GFS4: `),console.error($)};if(!P1[OD]){if(hL=global[OD]||[],zc(P1,hL),P1.close=function($){function D(J,X){return $.call(P1,J,function(Q){if(!Q)Wc();if(typeof X==="function")X.appl... L113: `)}}});var dX=t(()=>{Ql()});async function kW($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L111

4`){if(Y)X+=vk("");let H=Q?Sk(Q):void 0;if(Q&&H)X+=xk(H)}else if(z===` L5: `){if(Q&&Sk(Q))X+=xk(Q);if(Y)X+=vk(Y)}}return X},pM0;var TM=t(()=>{RM();jM=`${lM0}8;;`,Pk=new RegExp(`(?:\\${kk}(?<code>\\d+)m|\\${jM}(?<uri>.*)${IM})`,"y"),pM0=/\r?\n/});var O1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function M$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

5`){if(Y)$+=MMA("");let q=J?CMA(J):void 0;if(J&&q)$+=OMA(q)}else if(U===` L6: `){if(J&&CMA(J))$+=OMA(J);if(Y)$+=MMA(Y)}}return $},jKQ;var mBA=uA(()=>{yBA();uBA=`${VKQ}8;;`,IMA=new RegExp(`(?:\\${NMA}(?<code>\\d+)m|\\${uBA}(?<uri>.*)${hBA})`,"y"),jKQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function k1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1649contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${tDA} in the Cap-go org.`).action(Q9Q);F$.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1649

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=MMA("");let q=J?CMA(J):void 0;if(J&&q)$+=OMA(q)}else if(U===` L6: `){if(J&&CMA(J))$+=OMA(J);if(Y)$+=MMA(Y)}}return $},jKQ;var mBA=uA(()=>{yBA();uBA=`${VKQ}8;;`,IMA=new RegExp(`(?:\\${NMA}(?<code>\\d+)m|\\${uBA}(?<uri>.*)${hBA})`,"y"),jKQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function k1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$