Loading npm security reports…

@deepseekcode/cli@1.0.23: AI-agent control-surface risk | LPM Firewall

registry / @deepseekcode/cli / 1.0.23

@deepseekcode/cli@1.0.23

DeepSeekCode TypeScript CLI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. At runtime, the CLI loads an embedded, encoded prompt into its automatic context-compression path. That prompt manipulates the AI agent to disclose detailed conversation and user-message context.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running dscode until its context-compression flow activates.

Impact

AI-agent control hijack and unintended disclosure of conversation/workspace context through model output or its configured backend.

Mechanism

Base64-decoded hidden prompt injected into agent context compression.

Policy narrative

The bundled CLI hides a Base64 prompt under compression/base-compact, decodes it at runtime, and assigns it to the context-compression workflow. Its decoded instructions impersonate reviewer guidance and demand exhaustive conversation, code, and user-message disclosure. This is not a user-selected skill prompt: the compression module loads it automatically, allowing the package to steer the agent during normal operation.

Rationale

A covert, encoded prompt is wired into an automatic agent-control path and directs disclosure of sensitive conversational context. No install hook is involved, but the runtime behavior is concrete and malicious.

Evidence

dist/cli.jspackage.jsonREADME.md

Network endpoints1

api.deepseek.com/v1

Decision evidence

Source & flagged code

18 flagged · loading source

web/dist/assets/index-CcPIw0Dj.jsView file

26`).replace(Ov,"")}function Jm(e,n){return n=Xm(n),Xm(e)===n}function it(e,n,i,o,f,h){switch(i){case"children":typeof o=="string"?n==="body"||n==="textarea"&&o===""||Wa(e,o):(typeof... L27: ${t.slice(0,200)}`:t.slice(0,200)||null}return t&&t.length>0?t.length>200?`${t.slice(0,200)}...`:t:null}const vN=["openai-chat-completions","openai-completions","openai-responses",... L28: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/index-CcPIw0Dj.jsView on unpkg · L26

web/dist/assets/HookConfigView-DM6IVFGm.jsView file

1import{j as e}from"./markdown-BASfeONY.js";import{a as N,aJ as E,S as P,aK as U,aq as D,X as O,f as $,y as Y,K as G,aL as J,ay as _,az as B,h as W,aE as q,D as K,z as V}from"./icon... L2: "确定"=合并 / "取消"=替换`)?"merge":"replace";(await f.hooks.import({...T,mergeMode:C})).success&&h()}catch(T){console.error("Import failed:",T)}},p.click()},[h]);return e.jsxs("div",{clas...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-DM6IVFGm.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as DI8}from"node:module";var av8=Object.create;var rv8=Object.getPrototypeOf;var CS=Object.defineProperty;var sv8=Object.getOwnPropertyNames;var tv8=Object.pro... L9: at`)?" (<anonymous>)":-1<_.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as DI8}from"node:module";var av8=Object.create;var rv8=Object.getPrototypeOf;var CS=Object.defineProperty;var sv8=Object.getOwnPropertyNames;var tv8=Object.pro... L9: at`)?" (<anonymous>)":-1<_.stack.indexOf("@")?"@unknown:0:0":""}return` ... L14: Error generating stack: `+E.message+` L15: `+E.stack}}function n(O,Q){if(typeof O==="object"&&O!==null){var _=kr.get(O);if(_!==undefi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Source & flagged code

18 flagged

web/dist/assets/index-CcPIw0Dj.jsView file

26`).replace(Ov,"")}function Jm(e,n){return n=Xm(n),Xm(e)===n}function it(e,n,i,o,f,h){switch(i){case"children":typeof o=="string"?n==="body"||n==="textarea"&&o===""||Wa(e,o):(typeof... L27: ${t.slice(0,200)}`:t.slice(0,200)||null}return t&&t.length>0?t.length>200?`${t.slice(0,200)}...`:t:null}const vN=["openai-chat-completions","openai-completions","openai-responses",... L28: `).replace(/\n{3,}/g,`

High

Child Process

Package source references child process execution.

web/dist/assets/index-CcPIw0Dj.jsView on unpkg · L26

web/dist/assets/HookConfigView-DM6IVFGm.jsView file

Lines 1-3javascript

1import{j as e}from"./markdown-BASfeONY.js";import{a as N,aJ as E,S as P,aK as U,aq as D,X as O,f as $,y as Y,K as G,aL as J,ay as _,az as B,h as W,aE as q,D as K,z as V}from"./icons-BXecaLRH.js";import{c as X}from"./state-D4zgKwQs.js";import{a as f}from"./index-CcPIw0Dj.js";import"./react-vendor-7At16BnY.js";import"./panels-Bod3sKnK.js";const A=X((l,o)=>({rules:[],stats:null,events:[],agents:[],loading:!1,error:null,fieldErrors:null,formOpen:!1,editingRule:null,dryRunResult:null,loadRules:async()=>{const s=await f.hooks.list();s.success&&Array.isArray(s.data)?l({rules:s.data}):s.success&&s.dat ...

2"确定"=合并 / "取消"=替换`)?"merge":"replace";(await f.hooks.import({...T,mergeMode:C})).success&&h()}catch(T){console.error("Import failed:",T)}},p.click()},[h]);return e.jsxs("div",{className:"flex h-full min-h-0 flex-col bg-dark-bg text-dark-text",children:[e.jsxs("div",{className:"flex shrink-0 flex-wrap items-center justify-between gap-3 border-b border-dark-border px-6 py-4",children:[e.jsxs("div",{children:[e.jsx("h2",{className:"text-base font-semibold text-dark-text",children:"Hook 配置"}),e.jsx("p",{className:"mt-0.5 text-xs text-dark-muted",children:"在工具执行、任务流转等生命周期事件上挂载拦截器，实现审批与自定义逻辑"})]}),e ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/HookConfigView-DM6IVFGm.jsView on unpkg · L1

3

Long lines were clipped for display.

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as DI8}from"node:module";var av8=Object.create;var rv8=Object.getPrototypeOf;var CS=Object.defineProperty;var sv8=Object.getOwnPropertyNames;var tv8=Object.pro... L9: at`)?" (<anonymous>)":-1<_.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as DI8}from"node:module";var av8=Object.create;var rv8=Object.getPrototypeOf;var CS=Object.defineProperty;var sv8=Object.getOwnPropertyNames;var tv8=Object.pro... L9: at`)?" (<anonymous>)":-1<_.stack.indexOf("@")?"@unknown:0:0":""}return` ... L14: Error generating stack: `+E.message+` L15: `+E.stack}}function n(O,Q){if(typeof O==="object"&&O!==null){var _=kr.get(O);if(_!==undefi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1