@capgo/cli@8.42.4

A CLI to upload to capgo servers

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Direct inspection found a bundled Capgo CLI without lifecycle hooks or a concrete malicious execution chain. The scanner findings are explained by bundled dependencies and explicit CLI features.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Explicit CLI commands and options

Impact

No unconsented install-time execution, persistence, or exfiltration was found.

Mechanism

User-directed build, upload, analytics, and support operations

AI rationale

Direct inspection found a bundled Capgo CLI without lifecycle hooks or a concrete malicious execution chain. The scanner findings are explained by bundled dependencies and explicit CLI features.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package is a command-line tool with a bin entrypoint, not an install lifecycle hook.
The flagged bundles contain bundled libraries; inspection found no remote decoded-payload execution or automatic credential harvesting.

Evidence against

No preinstall, install, postinstall, or prepare script is declared.
Build-log transmission is tied to explicit CLI flags, including ai-analytics and send-logs-to-support.
The detected evaluation code is bundled DOM/schema-library functionality rather than an attacker-controlled payload path.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 512 KB of source, external domains: capgo.app, cli.github.com, console.capgo.app, developer.android.com, eu.i.posthog.com, github.com, semver.org

Oversized source lightweight scan

Source & flagged code

17 flagged

dist/src/sdk.jsView file

101`)};fS0.renderString=function(D,J,Q){var X="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L102: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return P8.red("Error:")+" Not valid JSON!"}return X+=fS0.render(Y,J,Q),X}});var D2=E((Qc)=>{Object.defineProperty(Qc,"__esModule",{valu... L103: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ix0($,D){var J=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L111: `)}),D}});var mn=E((nv1,gn)=>{var j7=D0("constants"),pu0=process.cwd,oz=null,iu0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!oz)oz=pu0.call(proces... L112: GFS4: `),console.error($)};if(

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L101

101`)};fS0.renderString=function(D,J,Q){var X="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L102: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return P8.red("Error:")+" Not valid JSON!"}return X+=fS0.render(Y,J,Q),X}});var D2=E((Qc)=>{Object.defineProperty(Qc,"__esModule",{valu... L103: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ix0($,D){var J=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L110: L111: `)}),D}});var mn=E((nv1,gn)=>{var j7=D0("constants"),pu0=process.cwd,oz=null,iu0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!oz)oz=pu0.call(proces... L112: GFS4: `),console.error(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L101

101`)};fS0.renderString=function(D,J,Q){var X="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L102: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return P8.red("Error:")+" Not valid JSON!"}return X+=fS0.render(Y,J,Q),X}});var D2=E((Qc)=>{Object.defineProperty(Qc,"__esModule",{valu... L103: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ix0($,D){var J=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,F;return{s:function(){J=J.call($)},n:function(){var U=J.next();return Y=U.done,U}... L105: `)}if(!D||typeof D!=="object")D={}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L101

111`)}),D}});var mn=E((nv1,gn)=>{var j7=D0("constants"),pu0=process.cwd,oz=null,iu0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!oz)oz=pu0.call(proces... L112: GFS4: `),console.error($)};if(!m$[_D]){if(d2=global[_D]||[],on(m$,d2),m$.close=function($){function D(J,Q){return $.call(m$,J,function(X){if(!X)rn();if(typeof Q==="function")Q.appl... L113: `)}}});var vX=s(()=>{np()});async function HK($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,Q=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L111

1import{createRequire as JR0}from"node:module";var module={exports:{}};var a20=Object.create;var{getPrototypeOf:t20,defineProperty:CF,getOwnPropertyNames:Df}=Object;var Rw=Object.pr... L2: `)}var Eq="\x1B",Of="",MR0=39,Cw="\x07",Lf="[",NR0="]",Mf="m",Pw,zf,Kf=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return... ... L7: `),Q=D.split(` L8: `),X=Math.max(J.length,Q.length),Y=[];for(let Z=0;Z<X;Z++)J[Z]!==Q[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:Q.length,numLines:X}}function B1($){return $==... L9: `).map((F,G,U)=>{let W=Y?Y(F,G):F;return G===0?`${Q}${W}`:G===U.length-1?`${X}${W}`:`${J}${W}`}).join(` ... L14: `).slice(Y);this.output.write(Z.join(` L15: `)),this._prevFrame=$;return}}this.output.write(pD.e

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L1

dist/index.jsView file

5`){if(Y)$+=qPA("");let z=J?DPA(J):void 0;if(J&&z)$+=zPA(z)}else if(U===` L6: `){if(J&&DPA(J))$+=zPA(J);if(Y)$+=qPA(Y)}}return $},iCQ;var U9A=dA(()=>{K9A();F9A=`${dCQ}8;;`,UPA=new RegExp(`(?:\\${OPA}(?<code>\\d+)m|\\${F9A}(?<uri>.*)${H9A})`,"y"),iCQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function w1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1810contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${gCA} in the Cap-go org.`).action(H2Q);E6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1810

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=qPA("");let z=J?DPA(J):void 0;if(J&&z)$+=zPA(z)}else if(U===` L6: `){if(J&&DPA(J))$+=zPA(J);if(Y)$+=qPA(Y)}}return $},iCQ;var U9A=dA(()=>{K9A();F9A=`${dCQ}8;;`,UPA=new RegExp(`(?:\\${OPA}(?<code>\\d+)m|\\${F9A}(?<uri>.*)${H9A})`,"y"),iCQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function w1(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$

Source & flagged code

17 flagged · loading source

dist/src/sdk.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L101

101`)};fS0.renderString=function(D,J,Q){var X="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L102: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return P8.red("Error:")+" Not valid JSON!"}return X+=fS0.render(Y,J,Q),X}});var D2=E((Qc)=>{Object.defineProperty(Qc,"__esModule",{valu... L103: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ix0($,D){var J=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L110: L111: `)}),D}});var mn=E((nv1,gn)=>{var j7=D0("constants"),pu0=process.cwd,oz=null,iu0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!oz)oz=pu0.call(proces... L112: GFS4: `),console.error(

Findings

4 Critical10 High5 Medium4 Low

CriticalCredential Exfiltrationdist/index.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighSame File Env Network Executiondist/src/sdk.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/src/sdk.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighObfuscated Payload Loaderdist/src/sdk.js

HighCross File Remote Execution Contextdist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

Affected versions and remediation

This report applies to @capgo/cli@8.42.4.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.42.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 14:50:46.112Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code