@capgo/cli@8.45.1: Suspicious npm security report (Warn)

Loading npm security reports…

@capgo/cli@8.45.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged

dist/src/sdk.jsView file

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L112: `)}),D}});var pp=E((Ru1,np)=>{var x7=D0("constants"),Yh0=process.cwd,VK=null,Zh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!VK)VK=Yh0.call(proces... L113: GFS4: `),console.error($)};if(

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

•matchType = previous_version_dangerous_delta matchedPackage = @capgo/cli@8.42.3 matchedIdentity = npm:QGNhcGdvL2NsaQ:8.42.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

112`)}),D}});var pp=E((Ru1,np)=>{var x7=D0("constants"),Yh0=process.cwd,VK=null,Zh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!VK)VK=Yh0.call(proces... L113: GFS4: `),console.error($)};if(!c$[_D]){if(AR=global[_D]||[],ep(c$,AR),c$.close=function($){function D(Q,X){return $.call(c$,Q,function(J){if(!J)sp();if(typeof X==="function")X.appl... L114: ${Q.trim()}`:"";return`This Capgo API requires @capgo/cli@${D} or newer. You are using @capgo/cli@${$}.${X}

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L112

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L111: L112: `)}),D}});var pp=E((Ru1,np)=>{var x7=D0("constants"),Yh0=process.cwd,VK=null,Zh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!VK)VK=Yh0.call(proces... L113: GFS4: `),console.error(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L102

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... L105: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,F;return{s:function(){Q=Q.call($)},n:function(){var U=Q.next();return Y=U.done,U}... L106: `)}if(!D||typeof D!=="object")D={}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L102

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L112

1import{createRequire as hE0}from"node:module";var module={exports:{}};var _E0=Object.create;var{getPrototypeOf:kE0,defineProperty:cF,getOwnPropertyNames:Qb}=Object;var ew=Object.pr... L2: `)}var fq="\x1B",Lb="",Dj0=39,YB="\x07",Mb="[",Qj0="]",Nb="m",ZB,Kb,Hb=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return... ... L7: `),X=D.split(` L8: `),J=Math.max(Q.length,X.length),Y=[];for(let Z=0;Z<J;Z++)Q[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:Q.length,numLinesAfter:X.length,numLines:J}}function i0($){return $==... L9: `).map((F,G,U)=>{let W=Y?Y(F,G):F;return G===0?`${X}${W}`:G===U.length-1?`${J}${W}`:`${Q}${W}`}).join(` ... L14: `).slice(Y);this.output.write(Z.join(` L15: `)),this._prevFrame=$;return}}this.output.write(iD.e

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L1

dist/index.jsView file

5`){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===` L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},_VQ;var n9A=mA(()=>{d9A();i9A=`${wVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),_VQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function RB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1836contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${SLA} in the Cap-go org.`).action(YzQ);w6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1836

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=DTA("");let q=J?zTA(J):void 0;if(J&&q)$+=qTA(q)}else if(U===` L6: `){if(J&&zTA(J))$+=qTA(J);if(Y)$+=DTA(Y)}}return $},_VQ;var n9A=mA(()=>{d9A();i9A=`${wVQ}8;;`,UTA=new RegExp(`(?:\\${OTA}(?<code>\\d+)m|\\${i9A}(?<uri>.*)${p9A})`,"y"),_VQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function RB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$

Source & flagged code

17 flagged · loading source

dist/src/sdk.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L112

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L111: L112: `)}),D}});var pp=E((Ru1,np)=>{var x7=D0("constants"),Yh0=process.cwd,VK=null,Zh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!VK)VK=Yh0.call(proces... L113: GFS4: `),console.error(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L102

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... L105: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,F;return{s:function(){Q=Q.call($)},n:function(){var U=Q.next();return Y=U.done,U}... L106: `)}if(!D||typeof D!=="object")D={}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L102

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L112

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L1

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1836

Source & flagged code

17 flagged

dist/src/sdk.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L112

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L111: L112: `)}),D}});var pp=E((Ru1,np)=>{var x7=D0("constants"),Yh0=process.cwd,VK=null,Zh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!VK)VK=Yh0.call(proces... L113: GFS4: `),console.error(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L102

102`)};av0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return k8.red("Error:")+" Not valid JSON!"}return J+=av0.render(Y,Q,X),J}});var b2=E((Fl)=>{Object.defineProperty(Fl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function h_0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... L105: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,F;return{s:function(){Q=Q.call($)},n:function(){var U=Q.next();return Y=U.done,U}... L106: `)}if(!D||typeof D!=="object")D={}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L102

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L112

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L1