@deepseekcode/cli@1.0.17: Clean npm security report (Allow)

Loading npm security reports…

@deepseekcode/cli@1.0.17: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

19 flagged

web/dist/assets/SessionGrid-CnK6naC_.jsView file

Lines 1-21javascript

1import{j as e,M as Ht,P as Pe}from"./markdown-D0iUI0Yw.js";import{r as p,v as Gt,ay as gt,h as ge,a as le,b as qe,ai as ft,X as Ee,aB as qt,aC as Kt,m as fe,s as ze,L as Se,au as Ke,F as Be,aD as Ue,aE as Wt,D as Jt,t as Xt,O as Zt,aa as Yt,aF as et,aG as Vt,R as ce,z as Qt,a4 as en,aH as tn,x as ht,aj as bt,av as nn,y as sn,Q as rn,aI as an,ao as on,aJ as ln,aq as cn,q as dn,aK as un,a0 as kt,a2 as pn,u as mn,an as xn,af as gn}from"./icons-B5yCkBjC.js";import{i as K,e as $,j as fn,k as tt,w as G,l as nt,u as xe,R as hn,a as ee,t as B,m as q,n as bn,W as kn,o as yn,p as He,b as Nn,M as wn,q as ...

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CnK6naC_.jsView on unpkg · L1

4`);return e.jsx("div",{className:`markdown-content ${t}`,style:{wordBreak:"break-word"},children:e.jsx(Ht,{components:{code({className:i,children:l,...u}){const g=/language-(\w+)/.exec(i||""),f=String(l).replace(/\n$/,"");return g&&g[1]?e.jsx(Rn,{language:g[1],code:f}):e.jsx("code",{className:"bg-dark-hover px-1.5 py-0.5 rounded text-sm font-mono text-accent-blue",...u,children:l})},a({href:i,children:l}){return e.jsx("a",{href:i,target:"_blank",rel:"noopener noreferrer",className:"text-accent-blue hover:underline",children:l})},table({children:i}){return e.jsx("div",{className:"overflow-x-aut ...

5`)){if(r.startsWith("---")||r.startsWith("+++")||r.startsWith("index ")||r.startsWith("diff --git")||r.startsWith("==="))continue;const a=r.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/);if(a){n&&t.push(n),n={oldStart:parseInt(a[1],10),oldLines:parseInt(a[2]??"1",10),newStart:parseInt(a[3],10),newLines:parseInt(a[4]??"1",10),lines:[]};continue}if(!r.startsWith("\\")){if(n&&(r.startsWith("+")||r.startsWith("-")||r.startsWith(" ")||r==="")){n.lines.push(r);continue}n&&r&&(t.push(n),n=null)}}return n&&t.push(n),t}function Nt(s){let t=s.oldStart,n=s.newStart;const r=[];for(const a of s.lines ...

6`);let n=0,r=0,a=0;for(const d of t)d.startsWith("@@")?a++:d.startsWith("+")&&!d.startsWith("+++")?n++:d.startsWith("-")&&!d.startsWith("---")&&r++;return{additions:n,deletions:r,hunks:a,filesChanged:1}}function Hn(s){const t=[],n=(a,d)=>{if(!d)return;const c=t[t.length-1];c&&c.type===a?c.text+=d:t.push({type:a,text:d})},r=(a,d)=>{if(typeof a=="string"){n(d,a);return}const c=a.type||d;if(typeof a.content=="string"){n(c,a.content);return}for(const o of a.content)r(o,c)};for(const a of s)r(a,"");return t}function wt(s,t){const n=Pe.languages[t];if(!n)return[{type:"",text:s}];try{return Hn(Pe.tok ...

7`)})]}),t.action&&e.jsxs("div",{className:"py-0.5 px-2 text-xs border-l-2 border-accent-yellow/40 bg-accent-yellow/5 rounded-r",children:[e.jsx("div",{className:"flex items-center gap-1 text-accent-yellow mb-0.5",children:"⚡ 执行"}),e.jsx("div",{className:"text-dark-text leading-snug font-mono text-[11px]",children:t.action})]}),t.toolCalls&&t.toolCalls.length>0&&t.toolCalls.map(x=>e.jsx("div",{className:"px-1 py-0.5",children:e.jsx(jt,{toolCall:x})},x.id)),t.result&&e.jsxs("div",{className:"py-0.5 px-2 text-xs border-l-2 border-accent-green/40 bg-accent-green/5 rounded-r",children:[e.jsx("div", ...

9`)})]})}const ds=p.memo(function({message:t,sessionId:n,onRegenerate:r,onDeleteMessage:a}){var S,y,R;const{t:d}=$(),c=q(T=>{var O;if(!n||!T.generatingSessions.includes(n))return!1;const I=T.messagesBySession[n];return I?((O=I[I.length-1])==null?void 0:O.id)===t.id:!1}),o=p.useMemo(()=>t.thinkingBlocks&&t.thinkingBlocks.length>0?t.thinkingBlocks:t.thinking?[{index:Number.MIN_SAFE_INTEGER,text:t.thinking}]:[],[t.thinkingBlocks,t.thinking]),[i,l]=p.useState({}),u=p.useRef(c);p.useEffect(()=>{u.current&&!c&&l(T=>{const I={...T};for(const O of o)I[O.index]=!0;return I}),u.current=c},[c,o]);const g= ...

11`)})}),e.jsx(ut,{ts:t.timestamp,align:"right",children:e.jsx(dt,{message:t,sessionId:n,onRegenerate:r,onDeleteMessage:a})})]})});if(b)return e.jsx("div",{className:"flex justify-center animate-fade-in-up px-1 py-1",children:e.jsx("div",{className:"text-[11px] text-dark-muted bg-dark-surface border border-dark-border/60 rounded-full px-3.5 py-1 max-w-[90%] text-center",children:t.content})});const k=!t.hookApproval&&!!(o.length>0||t.steps&&t.steps.length>0||t.toolCalls&&t.toolCalls.length>0);return e.jsx("div",{className:"group flex animate-fade-in-up px-1",children:e.jsxs("div",{className:"w-f ...

13`)})}):o.length===0&&!t.hookApproval&&((y=t.steps)!=null&&y.length)?null:o.length===0&&!t.hookApproval&&!((R=t.steps)!=null&&R.length)&&c?e.jsxs("div",{className:"flex items-center gap-3 py-1 text-xs text-dark-muted",children:[e.jsxs("span",{className:"flex items-center gap-1",children:[e.jsx("span",{className:"w-1.5 h-1.5 rounded-full bg-accent-blue animate-blink"}),e.jsx("span",{className:"w-1.5 h-1.5 rounded-full bg-accent-blue animate-blink",style:{animationDelay:"0.2s"}}),e.jsx("span",{className:"w-1.5 h-1.5 rounded-full bg-accent-blue animate-blink",style:{animationDelay:"0.4s"}})]}),d(" ...

14`,t-1)+1,r=s.slice(n,t);return r.startsWith("/")?/\s/.test(r)?{active:!1,query:""}:{active:!0,query:r.slice(1)}:{active:!1,query:""}}const _s=p.memo(function({sessionId:t,onSend:n,onStop:r,onPause:a,onResume:d,slashOptions:c}){const{t:o}=$(),i=q(m=>{var h;return((h=m.sessionInputs)==null?void 0:h[t])??""}),l=q(m=>m.setSessionInput),u=q(m=>{var h;return((h=m.generatingSessions)==null?void 0:h.includes(t))??!1}),g=q(m=>{var h;return((h=m.pausedSessions)==null?void 0:h.includes(t))??!1}),f=p.useRef(null),x=p.useRef(null),b=p.useRef(!1),[w,k]=p.useState([]),[S,y]=p.useState(!1),[R,T]=p.useState(!1 ...

15`,N-1)+1,E=i.slice(0,j)+`/${m.name} `+i.slice(N);M(E),C(),requestAnimationFrame(()=>{h==null||h.focus();const v=j+m.name.length+2;h&&(h.selectionStart=h.selectionEnd=v)})},[i,M,ne,C]),It=p.useCallback(m=>{const h=f.current,N=(h==null?void 0:h.selectionStart)??i.length,j=`$${m.id} `,E=i.slice(0,N)+j+i.slice(N);M(E),T(!1),Y.current=!1,L(!1),Z(""),requestAnimationFrame(()=>{h==null||h.focus();const v=N+j.length;h&&(h.selectionStart=h.selectionEnd=v)})},[i,M]),ie=p.useCallback(m=>{const h=Array.from(m);k(N=>{const j=je-N.length,E=N.slice();for(const v of h.slice(0,j)){if(!mt.test(v.name)){B.warnin ...

16`)}

18`:""},[w,o]),Mt=p.useCallback(m=>{const h=m.clipboardData.getData("text/plain");if(m.clipboardData.files&&m.clipboardData.files.length>0){m.preventDefault(),ie(m.clipboardData.files);return}if(!h||!ks(h))return;m.preventDefault();const{label:N}=ys(h),j=f.current;if(!j)return;const E=j.selectionStart,v=j.selectionEnd,_=j.value,D=_.slice(0,E)+N+_.slice(v);M(D),requestAnimationFrame(()=>{j.selectionStart=j.selectionEnd=E+N.length})},[M,ie]),we=p.useCallback(async()=>{const m=Ns(i);Y.current=!1,L(!1),C();const h=m.trim(),N=w.length>0;if(!h&&!N)return;const j=m.trim();if(j.startsWith("/")&&!N){cons ...

19 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

20 disabled:opacity-50 disabled:cursor-not-allowed`}),e.jsxs("div",{className:"flex items-center gap-2 px-2.5 pb-2.5",children:[e.jsx(ms,{}),e.jsx("span",{className:"text-[11px] text-dark-muted/80 font-mono truncate max-w-[10rem] hidden sm:block",children:Tt||""}),e.jsx("div",{className:"flex-1"}),Te>0&&i.length>0&&e.jsxs("span",{className:`text-[10px] tabular-nums ${Qe?"text-accent-red font-medium":"text-dark-muted/60"}`,children:["~",Te," tokens",Qe?` · ${o("chat.nearLimit")}`:""]}),!u&&e.jsx("button",{onClick:()=>T(!0),className:"flex h-8 w-8 items-center justify-center ro ...

21 hover:opacity-80 active:scale-95 disabled:opacity-25 disabled:cursor-not-allowed`,title:o("chat.sendBtn"),"aria-label":o("chat.sendBtn"),children:e.jsx(dn,{size:15,"aria-hidden":"true"})})]})]}),e.jsxs("div",{className:"mt-1.5 hidden sm:flex items-center justify-center gap-3 text-[10px] text-dark-muted/50 select-none",children:[e.jsx("span",{children:o("chat.shiftEnter")}),e.jsx("span",{"aria-hidden":"true",children:"·"}),e.jsx("span",{children:o("chat.escHint")})]}),e.jsx(gs,{open:R,onClose:()=>T(!1),onSelect:It})]})}),Is=p.memo(function(){const{t}=$(),[n,r]=p.useStat ...

Long lines were clipped for display.

web/dist/assets/HookConfigView-DbkxVuAs.jsView file

Lines 1-4javascript

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as tE8}from"node:module";var cE8=Object.create;var lE8=Object.getPrototypeOf;var KP=Object.defineProperty;var dE8=Object.getOwnPropertyNames;var iE8=Object.pro... L9: at`)?" (<anonymous>)":-1<M.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Source & flagged code

19 flagged · loading source

web/dist/assets/SessionGrid-CnK6naC_.jsView file

1import{j as e,M as Ht,P as Pe}from"./markdown-D0iUI0Yw.js";import{r as p,v as Gt,ay as gt,h as ge,a as le,b as qe,ai as ft,X as Ee,aB as qt,aC as Kt,m as fe,s as ze,L as Se,au as K... L2: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CnK6naC_.jsView on unpkg · L1

web/dist/assets/HookConfigView-DbkxVuAs.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index-YAnKQ1Q6.js","assets/markdown-D0iUI0Yw.js","assets/icons-B5yCkBjC.js","assets/react-vendor-Bxu3r3ox.js","asse... L2: import{a as j,_ as L}from"./index-YAnKQ1Q6.js";import{j as e}from"./markdown-D0iUI0Yw.js";import{r as N,ap as z,aq as F,ar as M,a4 as U,X as I,ao as $,C as Y,b as G,as as J,ac as B... L3: "确定"=合并 / "取消"=替换`)?"merge":"replace";(await C.hooks.import({...w,mergeMode:u})).success&&h()}catch(w){console.error("Import failed:",w)}},f.click()},[h]);return e.jsxs("div",{clas...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-DbkxVuAs.jsView on unpkg · L1

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Source & flagged code

19 flagged

web/dist/assets/SessionGrid-CnK6naC_.jsView file

Lines 1-21javascript

2`).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/SessionGrid-CnK6naC_.jsView on unpkg · L1

16`)}

19 resize-none focus:outline-none min-h-[44px] max-h-[40vh] leading-relaxed

Long lines were clipped for display.

web/dist/assets/HookConfigView-DbkxVuAs.jsView file

Lines 1-4javascript

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

@deepseekcode/cli@1.0.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code