@deepseekcode/cli@1.0.15: Suspicious npm security report (Warn)

Loading npm security reports…

@deepseekcode/cli@1.0.15: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged

web/dist/assets/SessionGrid-CU4xbLh6.jsView file

Lines 1-21javascript

1import{j as e,M as wt,P as je}from"./markdown-hmVtvQNZ.js";import{r as p,s as Nt,ar as Ve,e as se,a as ee,b as Ie,au as Qe,X as ue,av as Et,A as re,o as Se,L as pe,an as Re,F as Ae,aw as Te,ax as vt,D as jt,p as St,B as At,a5 as Tt,ay as Me,az as _t,R as me,w as Ct,$ as It,aA as Rt,u as Ot,aB as Lt,ao as Dt,aC as Ft,ak as $t,aD as Mt,ai as Pt,n as zt,aE as Bt,V as et,Z as Ut,q as Ht,ag as Gt,aa as qt}from"./icons-CjRO1znb.js";import{i as H,e as F,j as Wt,k as Kt,w as z,l as Pe,m as Zt,u as ne,R as Jt,a as Q,t as K,n as B,o as Xt,W as Yt,p as Vt,q as _e,b as Qt,r as ze,d as Ce}from"./index-DcT4 ...

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CU4xbLh6.jsView on unpkg · L1

4`);return e.jsx("div",{className:`markdown-content ${t}`,style:{wordBreak:"break-word"},children:e.jsx(wt,{components:{code({className:i,children:c,...u}){const g=/language-(\w+)/.exec(i||""),f=String(c).replace(/\n$/,"");return g&&g[1]?e.jsx(tn,{language:g[1],code:f}):e.jsx("code",{className:"bg-dark-hover px-1.5 py-0.5 rounded text-sm font-mono text-accent-blue",...u,children:c})},a({href:i,children:c}){return e.jsx("a",{href:i,target:"_blank",rel:"noopener noreferrer",className:"text-accent-blue hover:underline",children:c})},table({children:i}){return e.jsx("div",{className:"overflow-x-aut ...

5`)){if(r.startsWith("---")||r.startsWith("+++")||r.startsWith("index ")||r.startsWith("diff --git")||r.startsWith("==="))continue;const

6`);let n=0,r=0,a=0;for(const l of t)l.startsWith("@@")?a++:l.startsWith("+")&&!l.startsWith("+++")?n++:l.startsWith("-")&&!l.startsWith("---")&&r++;return{additions:n,deletions:r,hunks:a,filesChanged:1}}function mn(s){const t=[],n=(a,l)=>{if(!l)return;const o=t[t.length-1];o&&o.type===a?o.text+=l:t.push({type:a,text:l})},r=(a,l)=>{if(typeof a=="string"){n(l,a);return}const o=a.type||l;if(typeof a.content=="string"){n(o,a.content);return}for(const d of a.content)r(d,o)};for(const a of s)r(a,"");return t}function st(s,t){const n=je.languages[t];return n?mn(je.tokenize(s,n)):[{type:"",text:s}]}fu ...

7`)})]}),t.action&&e.jsxs("div",{className:"py-0.5 px-2 text-xs border-l-2 border-accent-yellow/40 bg-accent-yellow/5 rounded-r",children:[e.jsx("div",{className:"flex items-center gap-1 text-accent-yellow mb-0.5",children:"⚡ 执行"}),e.jsx("div",{className:"text-dark-text leading-snug font-mono text-[11px]",children:t.action})]}),t.toolCalls&&t.toolCalls.length>0&&t.toolCalls.map(

9`)})}),e.jsx(Ze,{ts:t.timestamp,align:"right",children:e.jsx(Ke,{message:t,sessionId:n,onRegenerate:r,onDeleteMessage:a})})]})});if(g)return e.jsx("div",{className:"flex justify-center animate-fade-in-up px-1 py-1",children:e.jsx("div",{className:"text-[11px] text-dark-muted bg-dark-surface border border-dark-border/60 rounded-full px-3.5 py-1 max-w-[90%] text-center",children:t.content})});const m=!t.hookApproval&&!!(t.thinking&&t.thinking.trim()||t.steps&&t.steps.length>0||t.toolCalls&&t.toolCalls.length>0);return e.jsx("div",{className:"group flex animate-fade-in-up px-1",children:e.jsxs("d ...

11`)})]}),t.toolCalls&&t.toolCalls.length>0&&!t.hookApproval&&e.jsx("div",{className:"mb-1 space-y-0.5",children:t.toolCalls.map(E=>e.jsx(at,{toolCall:E},E.id))})]}),t.content?e.jsx("div",{className:"leading-relaxed"

13`)})}):!t.thinking&&!t.hookApproval&&((w=t.steps)!=null&&w.length)?null:!t.thinking&&!t.hookApproval&&!((y=t.steps)!=null&&y.length)&&o?e.

14`)}

16`:""},[k,o]),ft=p.useCallback(x=>{const b=x.clipboardData.getData("text/plain");if(x.clipboardData.files&&x.clipboardData.files.length>0){x.preventDefault(),X(x.clipboardData.files);return}if

17 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

18 disabled:opacity-50 disabled:cursor-not-allowed`}),e.jsxs("div",{className:"flex items-center gap-2 px-2.5 pb-2.5",children:[e.jsx(Dn,{}),e.jsx("span",{className:"text-[11px] text-dark-muted/80 font-mono truncate max-w-[10rem] hidden sm:block",children:lt||""}),e.jsx("div",{className:"flex-1"}),fe>0&&d.length>0&&

19 hover:opacity-80 active:scale-95 disabled:opacity-25 disabled:cursor-not-allowed`,title:o("chat.sendBtn"),"aria-label":o("chat.sendBtn"),children:e.jsx(zt,{size:15,"aria-hidden":"true"})})]})]}),e.jsxs("div",{className:"mt-1.5 hidden sm:flex items-center justify-center gap-3 text-[10px] text-dark-muted/50 select-none",children:[e.jsx("span",{children:o("chat.shiftEnter")}),e.jsx("span",{"aria-hidden":"true",children:"·"}),e.jsx("span",{children:o("chat.escHint")})]})]})}),Xn=p.memo(function(){const{t}=F(),[n,r]=p.useState(0),[a,l]=p.useState(0),o=p.useCallback(()=>{con ...

20 ${n?"ring-1 ring-accent-blue":"hover:border-dark-muted/40"}

21 ${t.status==="running"?"border-l-2 border-l-accent-blue":"border-l-2 border-l-transparent"}`,children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(Qn,{status:t.status}),e.jsxs("div",{className:"flex-1 min-w-0",children:[e.jsxs("div",{className:"flex items-center gap-1.5",children:[e.jsx(

Long lines were clipped for display.

web/dist/assets/SkillsView-CEdocw75.jsView file

Lines 1-2javascript

1import{j as e}from"./markdown-hmVtvQNZ.js";import{r as l,R as M,A as X,ab as Z,P as ee,ac as se,a7 as O,a8 as $,ad as U,ae as

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as LF8}from"node:module";var jF8=Object.create;var QF8=Object.getPrototypeOf;var SE=Object.defineProperty;var AF8=Object.getOwnPropertyNames;var BF8=Object.pro... L9: at`)?" (<anonymous>)":-1<_.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Source & flagged code

18 flagged · loading source

web/dist/assets/SessionGrid-CU4xbLh6.jsView file

1import{j as e,M as wt,P as je}from"./markdown-hmVtvQNZ.js";import{r as p,s as Nt,ar as Ve,e as se,a as ee,b as Ie,au as Qe,X as ue,av as Et,A as re,o as Se,L as pe,an as Re,F as Ae... L2: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CU4xbLh6.jsView on unpkg · L1

web/dist/assets/SkillsView-CEdocw75.jsView file

1import{j as e}from"./markdown-hmVtvQNZ.js";import{r as l,R as M,A as X,ab as Z,P as ee,ac as se,a7 as O,a8 as $,ad as U,ae as te}from"./icons-CjRO1znb.js";import"./Toast-Bmm1ZZzF.j...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/SkillsView-CEdocw75.jsView on unpkg · L1

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

89L90: [truncated]`:K,path:this.relative(J),size:Bu8(J).size,truncated:X}}fileTree(z=".",D=2,J=200){const K=this.resolve(z);let X=0;const q=(Y,G)=>{X+=1;const Z=ju8(Y);const H=this.relati... L91: })`,{filename:"workflow-script.js"});const q=X.runInContext(K,{timeout:1000});const Y=await q(J);if(!Y){return BW({title:D.message||"Workflow",description:D.message||"Workflow",goa... ... L93: `)}const X=this.getPrimitive(z);if(X?.kind==="agent"){return await this.executeAgentPrimitive(X,z,D)}if(X?.kind==="tool"){return await this.executeToolPrimitive(X,z,D)}const q=this... L94: `)}const G=this.evalExpression(Y,this.expressionContext(D,K),D,z);let Z;const H=q.cases&&typeof q.cases==="object"?q.cases:undefined;if(H){const V=H[String(G)];if(typeof V==="strin... L95: `)} L96: `}function $S(z){if(

Source & flagged code

18 flagged

web/dist/assets/SessionGrid-CU4xbLh6.jsView file

Lines 1-21javascript

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CU4xbLh6.jsView on unpkg · L1

5`)){if(r.startsWith("---")||r.startsWith("+++")||r.startsWith("index ")||r.startsWith("diff --git")||r.startsWith("==="))continue;const

13`)})}):!t.thinking&&!t.hookApproval&&((w=t.steps)!=null&&w.length)?null:!t.thinking&&!t.hookApproval&&!((y=t.steps)!=null&&y.length)&&o?e.

14`)}

16`:""},[k,o]),ft=p.useCallback(x=>{const b=x.clipboardData.getData("text/plain");if(x.clipboardData.files&&x.clipboardData.files.length>0){x.preventDefault(),X(x.clipboardData.files);return}if

17 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

20 ${n?"ring-1 ring-accent-blue":"hover:border-dark-muted/40"}

Long lines were clipped for display.

web/dist/assets/SkillsView-CEdocw75.jsView file

Lines 1-2javascript

1import{j as e}from"./markdown-hmVtvQNZ.js";import{r as l,R as M,A as X,ab as Z,P as ee,ac as se,a7 as O,a8 as $,ad as U,ae as

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

@deepseekcode/cli@1.0.15

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code