@capgo/cli@8.68.0

A CLI to upload to capgo servers

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Inspection of package.json and the published entrypoints shows a normal Capgo CLI with no install lifecycle and no hidden exfiltration chain. Shell and network use is tied to explicit CLI and SDK operations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A person runs the capgo binary or calls an SDK method.

Impact

No unconsented credential theft, remote payload execution, or agent-control mutation was established.

Mechanism

Commands and SDK methods talk to the caller-configured Capgo API and local Capacitor project. There is no registry lifecycle script.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares @capgo/cli 8.68.0 with bin capgo pointing at dist/index.js and has no preinstall, install, or postinstall hook.
dist/index.js is a Node CLI entrypoint that runs when the capgo binary is invoked.
dist/updater-installed-worker.js is a worker_threads script that receives project and API parameters and emits onboarding scan telemetry, not an install hook.
dist/src/sdk.js exposes uploadBundle as an explicit SDK method that parses caller options and uses the supplied API key.

Evidence against

The bundle uses child_process for user-invoked Capacitor, git, clipboard, and shell helpers, which is expected for this CLI.
Bundled eval belongs to the happy-dom dependency used for HTML tooling, not a hidden payload loader.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

Source & flagged code

21 flagged

dist/updater-installed-worker.jsView file

88`)}),$}});var kM=C((o9D,uM)=>{var l0=t("constants"),wn=process.cwd,I5=null,Zn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!I5)I5=wn.call(process);r... L89: GFS4: `),console.error(D)};if(!fD[$$]){if(eI=global[$$]||[],hM(fD,eI),fD.close=function(D){function $(U,I){return D.call(fD,U,function(F){if(!F)mM();if(typeof I==="function")I.appl... L90: ${U.trim()}`:"";return`This Capgo API requires @capgo/cli@${$} or newer. You are using @capgo/cli@${D}.${I}

High

Child Process

Package source references child process execution.

dist/updater-installed-worker.jsView on unpkg · L88

160`;await va($,U);return}await AA(D,$)}async function TX(){let D=ba(vX());if(D&&SX(D)===".ts"&&Ca(vX()))return{config:await yA(D),path:VX()??D};let $=await jA();return{config:$.app.e... L161: `).slice(1).map((I)=>{let F=I.trim(),J=F.startsWith("at ")?F.slice(3):F,X=$,Q=J,Y=J.lastIndexOf(" (");if(Y!==-1&&J.endsWith(")"))X=J.slice(0,Y).trim()||$,Q=J.slice(Y+2,-1);else{let... L162: `)}var ls,oX,IR,JR=(D,$)=>{D.name="$ZodError",oX.value=$,Object.defineProperty(D,"issues",oX),oX.value=void 0,Object.defineProperty(D,"message",ls);let U=Object.getPrototypeOf(D);i...

High

Eval

Package source references dynamic code evaluation.

dist/updater-installed-worker.jsView on unpkg · L160

78`)};Yx.renderString=function($,U,I){var F="",J;if(typeof $!=="string"||$==="")return"";if($[0]!=="{"&&$[0]!=="["){var X;if($.indexOf("{")===-1)X=$.indexOf("[");else if($.indexOf("[... L79: `,$=$.substr(X)}try{J=JSON.parse($)}catch(Q){return Y0.red("Error:")+" Not valid JSON!"}return F+=Yx.render(J,U,I),F}});var GI=C((tz)=>{Object.defineProperty(tz,"__esModule",{value... L80: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ax(D,$){var U=D==null?null:typeof Symbol<"u"&&D[Symbol.iterator]||D["@@iterator"];if(U... ... L87: L88: `)}),$}});var kM=C((o9D,uM)=>{var l0=t("constants"),wn=process.cwd,I5=null,Zn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!I5)I5=wn.call(process);r... L89: GFS4: `),console.error(D)};if

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/updater-installed-worker.jsView on unpkg · L78

78`)};Yx.renderString=function($,U,I){var F="",J;if(typeof $!=="string"||$==="")return"";if($[0]!=="{"&&$[0]!=="["){var X;if($.indexOf("{")===-1)X=$.indexOf("[");else if($.indexOf("[... L79: `,$=$.substr(X)}try{J=JSON.parse($)}catch(Q){return Y0.red("Error:")+" Not valid JSON!"}return F+=Yx.render(J,U,I),F}});var GI=C((tz)=>{Object.defineProperty(tz,"__esModule",{value... L80: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function ax(D,$){var U=D==null?null:typeof Symbol<"u"&&D[Symbol.iterator]||D["@@iterator"];if(U... L81: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var J=!0,X=!1,Q;return{s:function(){U=U.call(D)},n:function(){var W=U.next();return J=W.done,W}... L82: `)}if(!$||typeof $!=="object")$={};if($

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/updater-installed-worker.jsView on unpkg · L78

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/updater-installed-worker.jsView on unpkg · L88

71Caused by: ${(L=K===null||K===void 0?void 0:K.name)!==null&&L!==void 0?L:"Error"}: ${Z}`,z)Y+=` (${z})`;if(K===null||K===void 0?void 0:K.stack)Y+=` L72: ${K.stack}`}else{var N;Y=(N=X===null||X===void 0?void 0:X.stack)!==null&&N!==void 0?N:""}let M=this.url.toString().length;if((X===null||X===void 0?void 0:X.name)==="AbortError"||(X... L73: `)!=-1,I=this._styles,F=I.length;while(F--){var J=v6[I[F]];if($=J.open+$.replace(J.closeRe,J.open)+J.close,U)$=$.replace(p_,function(X){return J.close+X+J.open})}return $}HD.setThe...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater-installed-worker.jsView on unpkg · L71

dist/src/sdk.jsView file

102`)};qu0.renderString=function(D,X,Q){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return s8.red("Error:")+" Not valid JSON!"}return J+=qu0.render(Y,X,Q),J}});var SE=E((pp)=>{Object.defineProperty(pp,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function eu0($,D){var X=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L112: `)}),D}});var So=E((Mc$,Po)=>{var e7=Q0("constants"),Nc0=process.cwd,bO=null,Bc0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!bO)bO=Nc0.call(proces... L113: GFS4: `),console.error($)};if(

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

135`);return U=Math.max(U,O.length),O});for(let K in q)if(Z[K])Z[K].push(...H[K],...Array(U-H[K].length).fill(""))}let F=Z.map((q,U)=>{if(U<Y-1){let H=be(q);return q.map((K,O)=>`${K}$... L136: `)}he.columnar=jr0});var pe=E((ce)=>{Object.defineProperty(ce,"__esModule",{value:!0});ce.TERMINAL_INFO=ce.CI_ENVIRONMENT_VARIABLES_DETECTED=ce.CI_ENVIRONMENT_VARIABLES=void 0;var ... L137: `}te.enforceLF=lr0;function nr0($,D=(X)=>!!X){let X=!1;return $.filter((Q)=>{if(X)return!0;if(D(Q))return!1;else return X=!0,!0})}te.dropWhile=nr0;var oe=["s","ms","μs"];function p...

High

Shell

Package source references shell execution.

dist/src/sdk.jsView on unpkg · L135

1import{createRequire as eT0}from"node:module";var module={exports:{}};var iT0=Object.create;var{getPrototypeOf:rT0,defineProperty:bG,getOwnPropertyNames:gg}=Object;var nw=Object.pr... L2: `)}var ZK="\x1B",Dm="",VC0=39,aw="\x07",Xm="[",zC0="]",Qm="m",sw,ag,sg=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return... ... L7: `),Q=D.split(` L8: `),J=Math.max(X.length,Q.length),Y=[];for(let Z=0;Z<J;Z++)X[Z]!==Q[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:X.length,numLinesAfter:Q.length,numLines:J}}function o0($){return $==... L9: `).map((F,G,W)=>{let q=Y?Y(F,G):F;return G===0?`${Q}${q}`:G===W.length-1?`${J}${q}`:`${X}${q}`}).join(` ... L14: `).slice(Y);this.output.write(Z.join(` L15: `)),this._prevFrame=$;return}}this.output.write(X6.e

dist/index.jsView file

5`){if(Y)$+=vvA("");let z=J?bvA(J):void 0;if(J&&z)$+=xvA(z)}else if(U===` L6: `){if(J&&bvA(J))$+=xvA(J);if(Y)$+=vvA(Y)}}return $},IvQ;var u7A=fA(()=>{f7A();h7A=`${qvQ}8;;`,kvA=new RegExp(`(?:\\${gvA}(?<code>\\d+)m|\\${h7A}(?<uri>.*)${y7A})`,"y"),IvQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function EB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}${W}`:`${B}${W}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1919contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${wjA} in the Cap-go org.`).action(cNQ);T6.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1919

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=vvA("");let z=J?bvA(J):void 0;if(J&&z)$+=xvA(z)}else if(U===` L6: `){if(J&&bvA(J))$+=xvA(J);if(Y)$+=vvA(Y)}}return $},IvQ;var u7A=fA(()=>{f7A();h7A=`${qvQ}8;;`,kvA=new RegExp(`(?:\\${gvA}(?<code>\\d+)m|\\${h7A}(?<uri>.*)${y7A})`,"y"),IvQ=/\r?\n/}... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function EB(A){return A==... L10: `).map((X,G,K)=>{let W=Y?Y(X,G):X;return G===0?`${$}${W}`:G===K.length-1?`${J}$

Source & flagged code

21 flagged · loading source

dist/updater-installed-worker.jsView file

High

Child Process

Package source references child process execution.

dist/updater-installed-worker.jsView on unpkg · L88

High

Eval

Package source references dynamic code evaluation.

dist/updater-installed-worker.jsView on unpkg · L160

Findings

4 Critical13 High6 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/updater-installed-worker.js

HighShelldist/src/sdk.js

HighEvaldist/updater-installed-worker.js

HighSame File Env Network Executiondist/updater-installed-worker.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/updater-installed-worker.js

HighSandbox Evasion Gated Capabilitydist/index.js

High

Affected versions and remediation

This report applies to @capgo/cli@8.68.0.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.68.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:19:55.896Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code