@dmccore/code@0.0.38-synaptic.3: Suspicious npm security report

Loading npm security reports…

@dmccore/code@0.0.38-synaptic.3: Suspicious npm security report | LPM Firewall

Source & flagged code

21 flagged

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$100, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$147, i as Terminal$1, l... L4: import { $ as declare, $a as addDelay, $c as compose, $i as provideService, $l as failVoid, $n as formatIso, $o as provide, $r as exit, $s as isTimeoutError, $t as toMultiDocumentO... L5: import { $ as run$5, $t as failCause$4, A as fromPull$1, B as mapEffect$2, Bt as fromTransform, C as flatMap$3, Cn as interruptAll, Ct as invalidate, D as fromEffect, Dn as Platfor... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

•context = xplorer's contract is the single argument `/select,"<path>"` with\n* only the path quoted; Node's default spawn quoting wraps the whole argument\n* when the path has spaces and Explorer misparses it, silently opening a\n* fallback folder. A single `-ArgumentList` string in Windows PowerShell 5.1\n* reaches the child's command line verbatim, preserving the raw switch.\n*\n* Exported so the Windows smoke test can drive the identical source through a\n* real PowerShell against a recording stub instead of Explorer.\n*/\nfunction [redacted](explorerCommand, target) {\n return `$ProgressPreference = 'SilentlyContinue'; Start-Process ${escapePowerShellStringLiteral(explorerCommand)} -ArgumentList ('/select,"' + ${escapePowerShellStringLiteral(target)} + '"')`;\n}\nfunction fileExplorerR

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bin.mjsView on unpkg

3Trigger-reachable chain: manifest.bin -> dist/bin.mjs L3: import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$100, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$147, i as Terminal$1, l... L4: import { $ as declare, $a as addDelay, $c as compose, $i as provideService, $l as failVoid, $n as formatIso, $o as provide, $r as exit, $s as isTimeoutError, $t as toMultiDocumentO... L5: import { $ as run$5, $t as failCause$4, A as fromPull$1, B as mapEffect$2, Bt as fromTransform, C as flatMap$3, Cn as interruptAll, Ct as invalidate, D as fromEffect, Dn as Platfor... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = @dmccore/code@0.0.33-synaptic.21 matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.33-synaptic.21 similarity = 0.567 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

9import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream";

High

Child Process

Package source references child process execution.

dist/bin.mjsView on unpkg · L9

42232const POSIX_PATH_DELIMITER = ":"; L42233: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L42234: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L42232

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; import { appendFile, copyFile, mkdir, open, readFile, readdir, rename, rm, rmdir, stat, symlink, unlink, writeFile } from "fs/promises"; import { createInterface } from "readline"; * readLine: Effect.die("unused"), * readLine: Effect.die("unused"), * readLine: Effect.die("unused"), * readLine: Effect.die("unused"), * readLine: Effect.die("unused"),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.mjsView on unpkg · L3

9import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20973: try: () => { L20974: const urlInstance = new URL(url, baseUrl()); L20975: for (let i = 0; i < params.params.length; i++) { ... L100932: * L100933: * Get a list of available tools with their JSON schema parameters for a specific provider and model combination. L100934: */ ... L117332: }, L117333: readFileSync(e, t) { L117334: let o = [];

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L9

3Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L3: import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$100, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$147, i as Terminal$1, l... L4: import { $ as declare, $a as addDelay, $c as compose, $i as provideService, $l as failVoid, $n as formatIso, $o as provide, $r as exit, $s as isTimeoutError, $t as toMultiDocumentO... L5: import { $ as run$5, $t as failCause$4, A as fromPull$1, B as mapEffect$2, Bt as fromTransform, C as flatMap$3, Cn as interruptAll, Ct as invalidate, D as fromEffect, Dn as Platfor... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

6772var require_log = /* @__PURE__ */ __commonJSMin(((exports) => { L6773: var node_process$2 = __require("process"); L6774: function debug(logLevel, ...messages) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.mjsView on unpkg · L6772

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodeServices-XK1CveK4.mjsView file

5Cross-file remote execution chain: dist/NodeServices-XK1CveK4.mjs spawns dist/Schema-EuiMzjom.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-XK1CveK4.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/NodeServices-Bqkx8Bg9.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-XK1CveK4.mjsView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-YM1To2Yt.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-YM1To2Yt.mjsView on unpkg

dist/BunPtyAdapter-R1XFwrwT.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-R1XFwrwT.mjsView on unpkg

Source & flagged code

21 flagged · loading source

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bin.mjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L3

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

9import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream";

High

Child Process

Package source references child process execution.

dist/bin.mjsView on unpkg · L9

42232const POSIX_PATH_DELIMITER = ":"; L42233: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L42234: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L42232

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.mjsView on unpkg · L3

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L9

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

6772var require_log = /* @__PURE__ */ __commonJSMin(((exports) => { L6773: var node_process$2 = __require("process"); L6774: function debug(logLevel, ...messages) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.mjsView on unpkg · L6772

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodeServices-XK1CveK4.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-XK1CveK4.mjsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-XK1CveK4.mjsView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-YM1To2Yt.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-YM1To2Yt.mjsView on unpkg

dist/BunPtyAdapter-R1XFwrwT.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-R1XFwrwT.mjsView on unpkg

Source & flagged code

21 flagged

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bin.mjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L3

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.mjsView on unpkg

9import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream";

High

Child Process

Package source references child process execution.

dist/bin.mjsView on unpkg · L9

42232const POSIX_PATH_DELIMITER = ":"; L42233: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L42234: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L42232

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.mjsView on unpkg · L3

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L9

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

6772var require_log = /* @__PURE__ */ __commonJSMin(((exports) => { L6773: var node_process$2 = __require("process"); L6774: function debug(logLevel, ...messages) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin.mjsView on unpkg · L6772

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 7295477 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodeServices-XK1CveK4.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-XK1CveK4.mjsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodeServices-XK1CveK4.mjsView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/NodePtyAdapter-YM1To2Yt.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-YM1To2Yt.mjsView on unpkg

dist/BunPtyAdapter-R1XFwrwT.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-R1XFwrwT.mjsView on unpkg

@dmccore/code@0.0.38-synaptic.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code