registry / AI-agent capability abuse / @capgo/cli / 8.51.1

@capgo/cli@8.51.1

A CLI to upload to capgo servers

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No install lifecycle hook or confirmed theft/payload execution was found. The explicit but broad GitHub account-mutation capability and unresolved generated import warrant a warning rather than publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user or MCP client invokes GitHub-star functionality.

Impact

The package can make unwanted external GitHub account changes.

Mechanism

Authenticated GitHub CLI starring and runtime-generated dynamic import.

AI rationale

Evidence

package.jsondist/index.jsdist/src/sdk.js

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes bundled CLI and SDK runtime entry points.
The CLI can issue authenticated GitHub API PUT requests that star repositories.
The CLI exposes a bulk GitHub-starring MCP tool.
The SDK bundle uses a Function-created dynamic import, which remains difficult to fully assess in the large minified artifact.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
The normal upload path presents a GitHub-star prompt before acting.
No confirmed credential exfiltration or remote decoded-payload execution was established from the inspected source.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 512 KB of source, external domains: capgo.app, console.capgo.app, developer.android.com, eu.i.posthog.com, github.com, semver.org

Oversized source lightweight scan

Source & flagged code

18 flagged

dist/src/sdk.jsView file

102`)};_v0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return f8.red("Error:")+" Not valid JSON!"}return J+=_v0.render(Y,Q,X),J}});var aB=E((Sl)=>{Object.defineProperty(Sl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Bk0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L112: `)}),D}});var Oi=E((Iu1,Vi)=>{var v7=Q0("constants"),mh0=process.cwd,CK=null,dh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!CK)CK=mh0.call(proces... L113: GFS4: `),console.error($)};if(

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

•matchType = previous_version_dangerous_delta matchedPackage = @capgo/cli@8.50.3 matchedIdentity = npm:QGNhcGdvL2NsaQ:8.50.3 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

102`)};_v0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return f8.red("Error:")+" Not valid JSON!"}return J+=_v0.render(Y,Q,X),J}});var aB=E((Sl)=>{Object.defineProperty(Sl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Bk0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L111: L112: `)}),D}});var Oi=E((Iu1,Vi)=>{var v7=Q0("constants"),mh0=process.cwd,CK=null,dh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!CK)CK=mh0.call(proces... L113: GFS4: `),console.error(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L102

102`)};_v0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return f8.red("Error:")+" Not valid JSON!"}return J+=_v0.render(Y,Q,X),J}});var aB=E((Sl)=>{Object.defineProperty(Sl,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Bk0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... L105: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,F;return{s:function(){Q=Q.call($)},n:function(){var U=Q.next();return Y=U.done,U}... L106: `)}if(!D||typeof D!=="object")D={}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L102

112`)}),D}});var Oi=E((Iu1,Vi)=>{var v7=Q0("constants"),mh0=process.cwd,CK=null,dh0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!CK)CK=mh0.call(proces... L113: GFS4: `),console.error($)};if(!c$[vD]){if(bR=global[vD]||[],Ri(c$,bR),c$.close=function($){function D(Q,X){return $.call(c$,Q,function(J){if(!J)Bi();if(typeof X==="function")X.appl... L114: ${Q.trim()}`:"";return`This Capgo API requires @capgo/cli@${D} or newer. You are using @capgo/cli@${$}.${X}

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L112

1import{createRequire as Bj0}from"node:module";var module={exports:{}};var Oj0=Object.create;var{getPrototypeOf:zj0,defineProperty:pF,getOwnPropertyNames:Ab}=Object;var H2=Object.pr... L2: `)}var tq="\x1B",gb="",uj0=39,M2="\x07",mb="[",bj0="]",db="m",N2,fb,ub=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return... ... L7: `),X=D.split(` L8: `),J=Math.max(Q.length,X.length),Y=[];for(let Z=0;Z<J;Z++)Q[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:Q.length,numLinesAfter:X.length,numLines:J}}function r0($){return $==... L9: `).map((F,G,U)=>{let W=Y?Y(F,G):F;return G===0?`${X}${W}`:G===U.length-1?`${J}${W}`:`${Q}${W}`}).join(` ... L14: `).slice(Y);this.output.write(Z.join(` L15: `)),this._prevFrame=$;return}}this.output.write(iD.e

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L1

dist/index.jsView file

5`){if(Y)$+=A_A("");let q=J?tTA(J):void 0;if(J&&q)$+=eTA(q)}else if(U===` L6: `){if(J&&tTA(J))$+=eTA(J);if(Y)$+=A_A(Y)}}return $},bNQ;var LJA=mA(()=>{IJA();CJA=`${_NQ}8;;`,sTA=new RegExp(`(?:\\${B_A}(?<code>\\d+)m|\\${CJA}(?<uri>.*)${MJA})`,"y"),bNQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1852contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${WVA} in the Cap-go org.`).action(AqQ);z6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1852

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=A_A("");let q=J?tTA(J):void 0;if(J&&q)$+=eTA(q)}else if(U===` L6: `){if(J&&tTA(J))$+=eTA(J);if(Y)$+=A_A(Y)}}return $},bNQ;var LJA=mA(()=>{IJA();CJA=`${_NQ}8;;`,sTA=new RegExp(`(?:\\${B_A}(?<code>\\d+)m|\\${CJA}(?<uri>.*)${MJA})`,"y"),bNQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$

Source & flagged code

18 flagged · loading source

dist/src/sdk.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/sdk.jsView on unpkg

Findings

5 Critical10 High5 Medium4 Low

CriticalCredential Exfiltrationdist/index.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/src/sdk.js

HighSame File Env Network Executiondist/src/sdk.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/src/sdk.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighObfuscated Payload Loaderdist/src/sdk.js

HighCross File Remote Execution Contextdist/index.js

Affected versions and remediation

This report applies to @capgo/cli@8.51.1.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.51.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 14:56:03.982Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code