1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
Critical
Download Execute
Source downloads or fetches remote code and executes it.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bundle/index.js:
import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ...
!function(e){var t=mimeDb,r=require$$1__default.extname,A=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=A.exec(e),i=r&&t[r[1].toLowe...
*/lodash$2.exports,function(e,t){(function(){var r,A="Expected a function",n="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,...
*/var isExtendable=function(e){return null!=e&&("object"==typeof e||"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1Cross-file remote execution chain: comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js spawns comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.js; helper contains network access plus dynamic code execution.
L1: import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bundle/index.js:
import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ...
!function(e){var t=mimeDb,r=require$$1__default.extname,A=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=A.exec(e),i=r&&t[r[1].toLowe...
*/lodash$2.exports,function(e,t){(function(){var r,A="Expected a function",n="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,...
*/var isExtendable=function(e){return null!=e&&("object"==typeof e||"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1
1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
Critical
Download Execute
Source downloads or fetches remote code and executes it.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
...
L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t...
L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo...
L37: /**
...
L4
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1
1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo...
L2: /*!
...
L7: */
L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c...
L9: /*!
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1