5`){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===`
L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function jB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(`
...
L15: `).slice(Y);this.outpu
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L5 1836contains invisible/control Unicode U+200D (zero width joiner)
If you do not pass a repository name, this defaults to ${SLA} in the Cap-go org.`).action($zQ);w6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf
CriticalTrojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L1836 5Trigger-reachable chain: manifest.main -> dist/index.js
L5: `){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===`
L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function jB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L5 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
`){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
`)},info:(A,Q)=>{v.message(A,{...Q,symbol:R0("blue",oVQ)})},success:(A,Q)=>{v.message(A,{...Q,symbol:R0("green",sVQ)})},step:(A,Q)=>{v.message(A,{...Q,symbol:R0("green",XJA)})},war...
`).slice(1).map(($)=>{let J=$.trim(),Y=J.startsWith("at ")?J.slice(3):J,Z=Q,X=Y,G=Y.lastIndexOf(" (");if(G!==-1&&Y.endsWith(")"))Z=Y.slice(0,G).trim()||Q,X=Y.slice(G+2,-1);else{let...
${H.stack}`}else{var O;G=(O=Z===null||Z===void 0?void 0:Z.stack)!==null&&O!=
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 5`){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===`
L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function jB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(`
...
L15: `).slice(Y);this.outpu
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L5 5Cross-file remote execution chain: dist/index.js spawns dist/src/sdk.js; helper contains network access plus dynamic code execution.
L5: `){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===`
L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function jB(A){return A==...
L10: `)
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L5 5Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js
L5: `){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===`
L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},PVQ;var n9A=mA(()=>{d9A();i9A=`${EVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),PVQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function jB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.jsView on unpkg · L5 80Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js
L80: `)};TjQ.renderString=function(Q,B,$){var J="",Y;if(typeof Q!=="string"||Q==="")return"";if(Q[0]!=="{"&&Q[0]!=="["){var Z;if(Q.indexOf("{")===-1)Z=Q.indexOf("[");else if(Q.indexOf("...
L81: `,Q=Q.substr(Z)}try{Y=JSON.parse(Q)}catch(X){return e3.red("Error:")+" Not valid JSON!"}return J+=TjQ.render(Y,B,$),J}});var rJA=$A((GbA)=>{Object.defineProperty(GbA,"__esModule",{...
L82: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function OwQ(A,Q){var B=A==null?null:typeof Symbol<"u"&&A[Symbol.iterator]||A["@@iterator"];if(...
L83: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,X;return{s:function(){B=B.call(A)},n:function
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L80 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg •matchType = normalized_sha256
matchedPackage = @capgo/cli@8.45.2
matchedPath = dist/index.js
matchedIdentity = npm:QGNhcGdvL2NsaQ:8.45.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg •path = dist/index.js
kind = oversized_source_file
sizeBytes = 5010198
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/index.jsView on unpkg •path = dist/index.js
kind = oversized_cli_entrypoint
sizeBytes = 5010198
magicHex = [redacted]
MediumOversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/index.jsView on unpkg