2Trigger-reachable chain: manifest.exports -> dist/bundled/index.js
L2: var nP8=Object.create;var{getPrototypeOf:aP8,defineProperty:pP0,getOwnPropertyNames:cF1,getOwnPropertyDescriptor:rP8}=Object,dF1=Object.prototype.hasOwnProperty;var z6=($,Z,J)=>{J=...
L3: `,"utf8")}finally{await J.close()}}async clear(){await ME8(this.filePath,{force:!0})}}class ws0{credentials;async load(){return this.credentials}async save($){this.credentials=$}as...
L4: `).entries())if($.regex.test(J))yield{path:$.path,lineNumber:Z+1,line:J}}function yE0($){return typeof $==="string"?$:QS8.decode($)}var QS8;var nz=P(()=>{KI1();r$0();QS8=new TextDe...
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bundled/index.jsView on unpkg · L2 1663return `+str.trim()+`;
L1664: }());`;return eval(str)||{}}catch($){if(wrap!==!1&&/(unexpected|identifier)/i.test($.message))return parse(str,options,!1);throw SyntaxError($)}},stringify:function(){throw Error("...
L1665: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>
1// @bun
L2: var nP8=Object.create;var{getPrototypeOf:aP8,defineProperty:pP0,getOwnPropertyNames:cF1,getOwnPropertyDescriptor:rP8}=Object,dF1=Object.prototype.hasOwnProperty;var z6=($,Z,J)=>{J=...
L3: `,"utf8")}finally{await J.close()}}async clear(){await ME8(this.filePath,{force:!0})}}class ws0{credentials;async load(){return this.credentials}async save($){this.credentials=$}as...
L4: `).entries())if($.regex.test(J))yield{path:$.path,lineNumber:Z+1,line:J}}function yE0($){return typeof $==="string"?$:QS8.decode($)}var QS8;var nz=P(()=>{KI1();r$0();QS8=new TextDe...
...
L13: `)}`:"");this.errors=$,this.name="UnsubscriptionError"}}tE1.UnsubscriptionError=Kk0;class kA0{initialTeardown;static EMPTY=(()=>{let $=new kA0;return $.closed=!0,$})();closed=!1;_f...
L14: `,J);if(X===-1)return Z;Z+
HighObfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/bundled/index.jsView on unpkg · L1 2var nP8=Object.create;var{getPrototypeOf:aP8,defineProperty:pP0,getOwnPropertyNames:cF1,getOwnPropertyDescriptor:rP8}=Object,dF1=Object.prototype.hasOwnProperty;var z6=($,Z,J)=>{J=...
L3: `,"utf8")}finally{await J.close()}}async clear(){await ME8(this.filePath,{force:!0})}}class ws0{credentials;async load(){return this.credentials}async save($){this.credentials=$}as...
L4: `).entries())if($.regex.test(J))yield{path:$.path,lineNumber:Z+1,line:J}}function yE0($){return typeof $==="string"?$:QS8.decode($)}var QS8;var nz=P(()=>{KI1();r$0();QS8=new TextDe...
...
L14: `,J);if(X===-1)return Z;Z++,J=X+1}}function qb1($){let Z=$.length;while(Z>0&&$.charCodeAt(Z-1)===47)Z--;let J=$.slice(0,Z).replace(/\.git$/i,"");if(!J||J==="/")return"";return J.st...
L15: `)){if(J.length===0)continue;let X=J.s
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bundled/index.jsView on unpkg · L2 1Cross-file remote execution chain: dist/bundled/index.js spawns dist/cjs/index.js; helper contains network access plus dynamic code execution.
L1: // @bun
L2: var nP8=Object.create;var{getPrototypeOf:aP8,defineProperty:pP0,getOwnPropertyNames:cF1,getOwnPropertyDescriptor:rP8}=Object,dF1=Object.prototype.hasOwnProperty;var z6=($,Z,J)=>{J=...
L3: `,"utf8")}finally{await J.close()}}async clear(){await ME8(this.filePath,{force:!0})}}class ws0{credentials;async load(){return this.credentials}async save($){this.credentials=$}as...
L4: `).entries())if($.regex.test(J))yield{path:$.path,lineNumber:Z+1,line:J}}function yE0($){return typeof $==="string"?$:QS8.decode($)}var QS8;var nz=P(()=>{KI1();r$0();QS8=new TextDe...
...
L13: `)}`:"");this.errors=$,this.name="UnsubscriptionError"}}tE1.Unsubscripti
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/bundled/index.jsView on unpkg · L1 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/bundled/index.jsView on unpkg •path = dist/bundled/index.js
kind = oversized_source_file
sizeBytes = 5813013
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/bundled/index.jsView on unpkg