5`){if(Y)$+=Q_A("");let q=J?eTA(J):void 0;if(J&&q)$+=A_A(q)}else if(U===`
L6: `){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(`
...
L15: `).slice(Y);this.outpu
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L5 1856contains invisible/control Unicode U+200D (zero width joiner)
If you do not pass a repository name, this defaults to ${HVA} in the Cap-go org.`).action(AqQ);z6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf
CriticalTrojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L1856 5Trigger-reachable chain: manifest.main -> dist/index.js
L5: `){if(Y)$+=Q_A("");let q=J?eTA(J):void 0;if(J&&q)$+=A_A(q)}else if(U===`
L6: `){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L5 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
`){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
`)},info:(A,Q)=>{v.message(A,{...Q,symbol:E0("blue",QRQ)})},success:(A,Q)=>{v.message(A,{...Q,symbol:E0("green",BRQ)})},step:(A,Q)=>{v.message(A,{...Q,symbol:E0("green",vJA)})},war...
`).slice(1).map(($)=>{let J=$.trim(),Y=J.startsWith("at ")?J.slice(3):J,Z=Q,X=Y,G=Y.lastIndexOf(" (");if(G!==-1&&Y.endsWith(")"))Z=Y.slice(0,G).trim()||Q,X=Y.slice(G+2,-1);else{let...
${H.stack}`}else{var O;G=(O=Z===null||Z===void 0?void 0:Z.stack)!==null&&O!=
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 5`){if(Y)$+=Q_A("");let q=J?eTA(J):void 0;if(J&&q)$+=A_A(q)}else if(U===`
L6: `){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(`
...
L15: `).slice(Y);this.outpu
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L5 5Cross-file remote execution chain: dist/index.js spawns dist/src/sdk.js; helper contains network access plus dynamic code execution.
L5: `){if(Y)$+=Q_A("");let q=J?eTA(J):void 0;if(J&&q)$+=A_A(q)}else if(U===`
L6: `){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==...
L10: `)
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L5 5Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js
L5: `){if(Y)$+=Q_A("");let q=J?eTA(J):void 0;if(J&&q)$+=A_A(q)}else if(U===`
L6: `){if(J&&eTA(J))$+=A_A(J);if(Y)$+=Q_A(Y)}}return $},bNQ;var VJA=mA(()=>{OJA();LJA=`${_NQ}8;;`,tTA=new RegExp(`(?:\\${$_A}(?<code>\\d+)m|\\${LJA}(?<uri>.*)${CJA})`,"y"),bNQ=/\r?\n/}...
L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y]....
L8: `),$=Q.split(`
L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function VB(A){return A==...
L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.jsView on unpkg · L5 80Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js
L80: `)};xwQ.renderString=function(Q,B,$){var J="",Y;if(typeof Q!=="string"||Q==="")return"";if(Q[0]!=="{"&&Q[0]!=="["){var Z;if(Q.indexOf("{")===-1)Z=Q.indexOf("[");else if(Q.indexOf("...
L81: `,Q=Q.substr(Z)}try{Y=JSON.parse(Q)}catch(X){return YH.red("Error:")+" Not valid JSON!"}return J+=xwQ.render(Y,B,$),J}});var R5A=$A((nbA)=>{Object.defineProperty(nbA,"__esModule",{...
L82: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function NPQ(A,Q){var B=A==null?null:typeof Symbol<"u"&&A[Symbol.iterator]||A["@@iterator"];if(...
L83: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var Y=!0,Z=!1,X;return{s:function(){B=B.call(A)},n:function
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L80 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg •matchType = normalized_sha256
matchedPackage = @capgo/cli@8.45.2
matchedPath = dist/index.js
matchedIdentity = npm:QGNhcGdvL2NsaQ:8.45.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg •path = dist/index.js
kind = oversized_source_file
sizeBytes = 5045995
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/index.jsView on unpkg •path = dist/index.js
kind = oversized_cli_entrypoint
sizeBytes = 5045995
magicHex = [redacted]
MediumOversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/index.jsView on unpkg