@deepseekcode/cli@1.0.22: Clean npm security report (Allow)

Loading npm security reports…

@deepseekcode/cli@1.0.22: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

20 flagged

web/dist/assets/index-sYOn5Yyn.jsView file

26`).replace(cv,"")}function $m(e,n){return n=Hm(n),Hm(e)===n}function st(e,n,i,l,d,p){switch(i){case"children":typeof l=="string"?n==="body"||n==="textarea"&&l===""||Ha(e,l):(typeof... L27: ${t.slice(0,200)}`:t.slice(0,200)||null}return t&&t.length>0?t.length>200?`${t.slice(0,200)}...`:t:null}const jE=["openai-chat-completions","openai-completions","openai-responses",... L28: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/index-sYOn5Yyn.jsView on unpkg · L26

web/dist/assets/HookConfigView-BJ-VvTcl.jsView file

Lines 1-3javascript

1import{j as e}from"./markdown-4Q3UQbv9.js";import{a as N,aJ as E,S as P,aK as U,ar as D,X as O,f as $,y as Y,K as G,aL as J,az as _,aA as B,h as W,aE as q,D as K,z as V}from"./icons-ZBQi-Ogj.js";import{c as X}from"./state-4vIOJjS6.js";import{a as f}from"./index-sYOn5Yyn.js";import"./react-vendor-LdB92qnf.js";import"./panels-CwhLUZOq.js";const A=X((l,o)=>({rules:[],stats:null,events:[],agents:[],loading:!1,error:null,fieldErrors:null,formOpen:!1,editingRule:null,dryRunResult:null,loadRules:async()=>{const s=await f.hooks.list();s.success&&Array.isArray(s.data)?l({rules:s.data}):s.success&&s.dat ...

2"确定"=合并 / "取消"=替换`)?"merge":"replace";(await f.hooks.import({...T,mergeMode:C})).success&&h()}catch(T){console.error("Import failed:",T)}},p.click()},[h]);return e.jsxs("div",{className:"flex h-full min-h-0 flex-col bg-dark-bg text-dark-text",children:[e.jsxs("div",{className:"flex shrink-0 flex-wrap items-center justify-between gap-3 border-b border-dark-border px-6 py-4",children:[e.jsxs("div",{children:[e.jsx("h2",{className:"text-base font-semibold text-dark-text",children:"Hook 配置"}),e.jsx("p",{className:"mt-0.5 text-xs text-dark-muted",children:"在工具执行、任务流转等生命周期事件上挂载拦截器，实现审批与自定义逻辑"})]}),e ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-BJ-VvTcl.jsView on unpkg · L1

Long lines were clipped for display.

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as kk8}from"node:module";var Rk8=Object.create;var Pk8=Object.getPrototypeOf;var PS=Object.defineProperty;var Tk8=Object.getOwnPropertyNames;var wk8=Object.pro... L9: at`)?" (<anonymous>)":-1<N.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

Source & flagged code

20 flagged · loading source

web/dist/assets/index-sYOn5Yyn.jsView file

High

Child Process

Package source references child process execution.

web/dist/assets/index-sYOn5Yyn.jsView on unpkg · L26

web/dist/assets/HookConfigView-BJ-VvTcl.jsView file

1import{j as e}from"./markdown-4Q3UQbv9.js";import{a as N,aJ as E,S as P,aK as U,ar as D,X as O,f as $,y as Y,K as G,aL as J,az as _,aA as B,h as W,aE as q,D as K,z as V}from"./icon... L2: "确定"=合并 / "取消"=替换`)?"merge":"replace";(await f.hooks.import({...T,mergeMode:C})).success&&h()}catch(T){console.error("Import failed:",T)}},p.click()},[h]);return e.jsxs("div",{clas...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-BJ-VvTcl.jsView on unpkg · L1

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

Source & flagged code

20 flagged

web/dist/assets/index-sYOn5Yyn.jsView file

High

Child Process

Package source references child process execution.

web/dist/assets/index-sYOn5Yyn.jsView on unpkg · L26

web/dist/assets/HookConfigView-BJ-VvTcl.jsView file

Lines 1-3javascript

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-BJ-VvTcl.jsView on unpkg · L1

Long lines were clipped for display.

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L1

@deepseekcode/cli@1.0.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code