@capgo/cli@8.87.0

A CLI to upload to capgo servers

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the flagged dynamic loading and invisible characters resolve to project-config loading and UI instrumentation. The observed telemetry reports CLI exceptions to the package’s collector and is not evidence of credential exfiltration or malware.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes a CLI command; exception reporting occurs on an error path.

Impact

No credential export, unauthorized account action, or install-time mutation was confirmed.

Mechanism

The CLI sends error details and runtime diagnostics to the telemetry endpoint, with environment settings to disable reporting.

AI rationale

Network endpoints1

eu.i.posthog.com/i/v0/e/

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes dist/index.js as the CLI entrypoint and has no npm lifecycle hook.
dist/index.js parses user-invoked CLI commands; the reviewed telemetry path reports handled CLI exceptions.
The exception report contains error and runtime diagnostics and can be disabled through telemetry environment settings.
dist/src/sdk.js has the same exception reporting path to the PostHog collector.
The flagged dynamic loader resolves a local project config path before importing it; the invisible character match is in React timing instrumentation.
The worker files are launched by onboarding for updater checks and app-ready setup.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

19 flagged

dist/updater-installed-worker.jsView file

88`)}),$}});var xM=C((Y5D,_M)=>{var l0=o("constants"),vn=process.cwd,I5=null,Vn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!I5)I5=vn.call(process);r... L89: GFS4: `),console.error(D)};if(!fD[$$]){if(DJ=global[$$]||[],iM(fD,DJ),fD.close=function(D){function $(U,I){return D.call(fD,U,function(F){if(!F)nM();if(typeof I==="function")I.appl... L90: ${U.trim()}`:"";return`This Capgo API requires @capgo/cli@${$} or newer. You are using @capgo/cli@${D}.${I}

High

Child Process

Package source references child process execution.

dist/updater-installed-worker.jsView on unpkg · L88

161`;await Pa($,U);return}await SA(D,$)}async function bX(){let D=fa(VX());if(D&&TX(D)===".ts"&&ma(VX()))return{config:await hA(D),path:jX()??D};let $=await RA();return{config:$.app.e... L162: `).slice(1).map((I)=>{let F=I.trim(),J=F.startsWith("at ")?F.slice(3):F,X=$,Q=J,Y=J.lastIndexOf(" (");if(Y!==-1&&J.endsWith(")"))X=J.slice(0,Y).trim()||$,Q=J.slice(Y+2,-1);else{let... L163: `)}var ss,tX,XR,QR=(D,$)=>{D.name="$ZodError",tX.value=$,Object.defineProperty(D,"issues",tX),tX.value=void 0,Object.defineProperty(D,"message",ss);let U=Object.getPrototypeOf(D);i...

High

Eval

Package source references dynamic code evaluation.

dist/updater-installed-worker.jsView on unpkg · L161

78`)};qx.renderString=function($,U,I){var F="",J;if(typeof $!=="string"||$==="")return"";if($[0]!=="{"&&$[0]!=="["){var X;if($.indexOf("{")===-1)X=$.indexOf("[");else if($.indexOf("[... L79: `,$=$.substr(X)}try{J=JSON.parse($)}catch(Q){return Y0.red("Error:")+" Not valid JSON!"}return F+=qx.render(J,U,I),F}});var qI=C((sL)=>{Object.defineProperty(sL,"__esModule",{value... L80: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ug(D,$){var U=D==null?null:typeof Symbol<"u"&&D[Symbol.iterator]||D["@@iterator"];if(U... ... L87: L88: `)}),$}});var xM=C((Y5D,_M)=>{var l0=o("constants"),vn=process.cwd,I5=null,Vn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!I5)I5=vn.call(process);r... L89: GFS4: `),console.error(D)};if

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/updater-installed-worker.jsView on unpkg · L78

78`)};qx.renderString=function($,U,I){var F="",J;if(typeof $!=="string"||$==="")return"";if($[0]!=="{"&&$[0]!=="["){var X;if($.indexOf("{")===-1)X=$.indexOf("[");else if($.indexOf("[... L79: `,$=$.substr(X)}try{J=JSON.parse($)}catch(Q){return Y0.red("Error:")+" Not valid JSON!"}return F+=qx.render(J,U,I),F}});var qI=C((sL)=>{Object.defineProperty(sL,"__esModule",{value... L80: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Ug(D,$){var U=D==null?null:typeof Symbol<"u"&&D[Symbol.iterator]||D["@@iterator"];if(U... L81: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var J=!0,X=!1,Q;return{s:function(){U=U.call(D)},n:function(){var W=U.next();return J=W.done,W}... L82: `)}if(!$||typeof $!=="object")$={};if($

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/updater-installed-worker.jsView on unpkg · L78

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/updater-installed-worker.jsView on unpkg · L88

71Caused by: ${(z=K===null||K===void 0?void 0:K.name)!==null&&z!==void 0?z:"Error"}: ${Z}`,L)Y+=` (${L})`;if(K===null||K===void 0?void 0:K.stack)Y+=` L72: ${K.stack}`}else{var N;Y=(N=X===null||X===void 0?void 0:X.stack)!==null&&N!==void 0?N:""}let M=this.url.toString().length;if((X===null||X===void 0?void 0:X.name)==="AbortError"||(X... L73: `)!=-1,I=this._styles,F=I.length;while(F--){var J=v6[I[F]];if($=J.open+$.replace(J.closeRe,J.open)+J.close,U)$=$.replace(s_,function(X){return J.close+X+J.open})}return $}HD.setThe...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater-installed-worker.jsView on unpkg · L71

dist/src/sdk.jsView file

102`)};zu0.renderString=function(D,Q,X){var J="",Y;if(typeof D!=="string"||D==="")return"";if(D[0]!=="{"&&D[0]!=="["){var Z;if(D.indexOf("{")===-1)Z=D.indexOf("[");else if(D.indexOf("... L103: `,D=D.substr(Z)}try{Y=JSON.parse(D)}catch(F){return W9.red("Error:")+" Not valid JSON!"}return J+=zu0.render(Y,Q,X),J}});var pj=j((zp)=>{Object.defineProperty(zp,"__esModule",{valu... L104: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Xh0($,D){var Q=$==null?null:typeof Symbol<"u"&&$[Symbol.iterator]||$["@@iterator"];if(... ... L112: `)}),D}});var eo=j((On$,so)=>{var F7=X0("constants"),jl0=process.cwd,QO=null,El0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!QO)QO=jl0.call(proces... L113: GFS4: `),console.error($)};if(

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L102

135`);return U=Math.max(U,z.length),z});for(let K in q)if(Z[K])Z[K].push(...H[K],...Array(U-H[K].length).fill(""))}let F=Z.map((q,U)=>{if(U<Y-1){let H=Z00(q);return q.map((K,z)=>`${K}... L136: `)}F00.columnar=Co0});var z00=j((U00)=>{Object.defineProperty(U00,"__esModule",{value:!0});U00.TERMINAL_INFO=U00.CI_ENVIRONMENT_VARIABLES_DETECTED=U00.CI_ENVIRONMENT_VARIABLES=void... L137: `}L00.enforceLF=ro0;function oo0($,D=(Q)=>!!Q){let Q=!1;return $.filter((X)=>{if(Q)return!0;if(D(X))return!1;else return Q=!0,!0})}L00.dropWhile=oo0;var M00=["s","ms","μs"];functio...

High

Shell

Package source references shell execution.

dist/src/sdk.jsView on unpkg · L135

1import{createRequire as XP0}from"node:module";var module={exports:{}};var aC0=Object.create;var{getPrototypeOf:sC0,defineProperty:D3,getOwnPropertyNames:Fm}=Object;var GR=Object.pr... L2: `)}var AK="\x1B",Rm="",NP0=39,zR="\x07",jm="[",BP0="]",Em="m",OR,Lm,Nm=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return... ... L7: `),X=D.split(` L8: `),J=Math.max(Q.length,X.length),Y=[];for(let Z=0;Z<J;Z++)Q[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:Q.length,numLinesAfter:X.length,numLines:J}}function p0($){return $==... L9: `).map((F,G,W)=>{let q=Y?Y(F,G):F;return G===0?`${X}${q}`:G===W.length-1?`${J}${q}`:`${Q}${q}`}).join(` ... L14: `).slice(Y);this.output.write(Z.join(` L15: `)),this._prevFrame=$;return}}this.output.write(WD.e

dist/index.jsView file

5`){if(Y)$+=qlA("");let q=J?zlA(J):void 0;if(J&&q)$+=UlA(q)}else if(z===` L6: `){if(J&&zlA(J))$+=UlA(J);if(Y)$+=qlA(Y)}}return $},GoQ;var HKA=b(()=>{XKA();KKA=`${YoQ}8;;`,FlA=new RegExp(`(?:\\${IlA}(?<code>\\d+)m|\\${KKA}(?<uri>.*)${WKA})`,"y"),GoQ=/\r?\n/})... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function HB(A){return A==... L10: `).map((X,G,W)=>{let K=Y?Y(X,G):X;return G===0?`${$}${K}`:G===W.length-1?`${J}${K}`:`${B}${K}`}).join(` ... L15: `).slice(Y);this.outpu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L5

1931contains invisible/control Unicode U+200D (zero width joiner) If you do not pass a repository name, this defaults to ${nxA} in the Cap-go org.`).action(qgQ);m$.command("star-all [repositories...]").description("⭐ Star all Capgo GitHub repositories with a small random delay between each request.\n\nIf

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L1931

5Trigger-reachable chain: manifest.main -> dist/index.js L5: `){if(Y)$+=qlA("");let q=J?zlA(J):void 0;if(J&&q)$+=UlA(q)}else if(z===` L6: `){if(J&&zlA(J))$+=UlA(J);if(Y)$+=qlA(Y)}}return $},GoQ;var HKA=b(()=>{XKA();KKA=`${YoQ}8;;`,FlA=new RegExp(`(?:\\${IlA}(?<code>\\d+)m|\\${KKA}(?<uri>.*)${WKA})`,"y"),GoQ=/\r?\n/})... L7: `),Y=0,Z=A;for(let G of J){if(Z<=G.length)break;Z-=G.length+1,Y++}for(Y=Math.max(0,Math.min(J.length-1,Y+B)),Z=Math.min(Z,J[Y].length)+Q;Z<0&&Y>0;)Y--,Z+=J[Y].length+1;for(;Z>J[Y].... L8: `),$=Q.split(` L9: `),J=Math.max(B.length,$.length),Y=[];for(let Z=0;Z<J;Z++)B[Z]!==$[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:B.length,numLinesAfter:$.length,numLines:J}}function HB(A){return A==... L10: `).map((X,G,W)=>{let K=Y?Y(X,G):X;return G===0?`${$}${K}`:G===W.length-1?`${J}$

Source & flagged code

19 flagged · loading source

dist/updater-installed-worker.jsView file

High

Child Process

Package source references child process execution.

dist/updater-installed-worker.jsView on unpkg · L88

High

Eval

Package source references dynamic code evaluation.

dist/updater-installed-worker.jsView on unpkg · L161

Findings

4 Critical11 High6 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/updater-installed-worker.js

HighShelldist/src/sdk.js

HighEvaldist/updater-installed-worker.js

HighSame File Env Network Executiondist/updater-installed-worker.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/updater-installed-worker.js

HighObfuscated Payload Loaderdist/updater-installed-worker.js

Affected versions and remediation

This report applies to @capgo/cli@8.87.0.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.87.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 12:44:16.782Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code