@github/copilot-darwin-arm64: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@github/copilot-darwin-arm64: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

index.jsView file

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L8

sdk/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-darwin-arm64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/index.jsView on unpkg

87`&&(e="normal");break;case"blockComment":s==="*"&&o==="/"&&(r++,e="normal");break;case"normal":if(s==="'")n??=r,e="single";else if(s==='"')n??=r,e="double";else if(s==="`")n??=r,e=... L88: `||t==="\v"||t==="\f"||t==="\r"||t===" "||t==="\uFEFF"}function MAe(t){return t!==void 0&&/\s/u.test(t)}function OAe(t){if(!t.startsWith(`${_6}:`))return;let e=t.slice(_6.length+1)... L89: ${a.stderr}`:l,u=new Error(c);throw u.name=a.errorName??"Error",u.code=a.errorCode??a.exitCode,u.killed=a.killed,u.signal=a.signal??null,u.cmd=a.command,u.stdout=a.stdout,u.stderr=...

High

Shell

Package source references shell execution.

sdk/index.jsView on unpkg · L87

59const __esmShimDirname = __path.dirname(__esmShimFilename); L60: var twe=Object.create;var tM=Object.defineProperty;var nwe=Object.getOwnPropertyDescriptor;var rwe=Object.getOwnPropertyNames;var swe=Object.getPrototypeOf,owe=Object.prototype.has... L61: `);throw new Error(`Native addon "${t}" not found for ${n}. Tried: ... L105: \`\`\``)}async function BOe(t,e,n){let r=UOe(t,{encoding:"utf8"}),s=[],o=1,i="",a=!1,l=()=>{if(o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),o>=n)return{lines:s,lastLineRead:o,reac... L106: `){let g=l();if(g)return g;continue}o>=e&&o<=n&&(i.length<HOe?i+=m:a=!0)}}return o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),{lines:s,lastLineRead:o,reachedEOF:!0}}function c8(t)... L107: Here is a potentially relevant text excerpt in \`${T}\` starting at line ${E}:`),y.p

preloads/extension_bootstrap.mjsView file

15// Register a CJS require hook so that CommonJS extensions can L16: // `require("@github/copilot-sdk")` and have it resolve to the bundled SDK. L17: const sdkPath = process.env.COPILOT_SDK_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preloads/extension_bootstrap.mjsView on unpkg · L15

copilot-sdk/index.jsView file

851Cross-file remote execution chain: copilot-sdk/index.js spawns index.js; helper contains network access plus dynamic code execution. L851: /** L852: * To be kept private to fire an event to L853: * subscribers ... L1389: try { L1390: await this.writable.write(headers.join(""), "ascii"); L1391: return this.writable.write(data); ... L2902: fromString(value, encoding) { L2903: return Buffer.from(value, encoding); L2904: } ... L3070: var crypto_1 = __require("crypto"); L3071: var net_1 = __require("net"); L3072: var api_1 = require_api();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

copilot-sdk/index.jsView on unpkg · L851

copilotView file

•path = copilot kind = native_binary sizeBytes = 152660608 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

13 flagged

index.jsView file

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L8

sdk/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-darwin-arm64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/index.jsView on unpkg

87`&&(e="normal");break;case"blockComment":s==="*"&&o==="/"&&(r++,e="normal");break;case"normal":if(s==="'")n??=r,e="single";else if(s==='"')n??=r,e="double";else if(s==="`")n??=r,e=... L88: `||t==="\v"||t==="\f"||t==="\r"||t===" "||t==="\uFEFF"}function MAe(t){return t!==void 0&&/\s/u.test(t)}function OAe(t){if(!t.startsWith(`${_6}:`))return;let e=t.slice(_6.length+1)... L89: ${a.stderr}`:l,u=new Error(c);throw u.name=a.errorName??"Error",u.code=a.errorCode??a.exitCode,u.killed=a.killed,u.signal=a.signal??null,u.cmd=a.command,u.stdout=a.stdout,u.stderr=...

High

Shell

Package source references shell execution.

sdk/index.jsView on unpkg · L87

59const __esmShimDirname = __path.dirname(__esmShimFilename); L60: var twe=Object.create;var tM=Object.defineProperty;var nwe=Object.getOwnPropertyDescriptor;var rwe=Object.getOwnPropertyNames;var swe=Object.getPrototypeOf,owe=Object.prototype.has... L61: `);throw new Error(`Native addon "${t}" not found for ${n}. Tried: ... L105: \`\`\``)}async function BOe(t,e,n){let r=UOe(t,{encoding:"utf8"}),s=[],o=1,i="",a=!1,l=()=>{if(o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),o>=n)return{lines:s,lastLineRead:o,reac... L106: `){let g=l();if(g)return g;continue}o>=e&&o<=n&&(i.length<HOe?i+=m:a=!0)}}return o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),{lines:s,lastLineRead:o,reachedEOF:!0}}function c8(t)... L107: Here is a potentially relevant text excerpt in \`${T}\` starting at line ${E}:`),y.p

preloads/extension_bootstrap.mjsView file

15// Register a CJS require hook so that CommonJS extensions can L16: // `require("@github/copilot-sdk")` and have it resolve to the bundled SDK. L17: const sdkPath = process.env.COPILOT_SDK_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preloads/extension_bootstrap.mjsView on unpkg · L15

copilot-sdk/index.jsView file

851Cross-file remote execution chain: copilot-sdk/index.js spawns index.js; helper contains network access plus dynamic code execution. L851: /** L852: * To be kept private to fire an event to L853: * subscribers ... L1389: try { L1390: await this.writable.write(headers.join(""), "ascii"); L1391: return this.writable.write(data); ... L2902: fromString(value, encoding) { L2903: return Buffer.from(value, encoding); L2904: } ... L3070: var crypto_1 = __require("crypto"); L3071: var net_1 = __require("net"); L3072: var api_1 = require_api();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

copilot-sdk/index.jsView on unpkg · L851

copilotView file

•path = copilot kind = native_binary sizeBytes = 152660608 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

builtin-plugins/computer-use/0.1.71/darwin-arm64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg