@github/copilot-darwin-x64@1.0.71: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@github/copilot-darwin-x64@1.0.71: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-darwin-x64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L8

preloads/extension_bootstrap.mjsView file

15// Register a CJS require hook so that CommonJS extensions can L16: // `require("@github/copilot-sdk")` and have it resolve to the bundled SDK. L17: const sdkPath = process.env.COPILOT_SDK_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preloads/extension_bootstrap.mjsView on unpkg · L15

copilot-sdk/index.jsView file

839Cross-file remote execution chain: copilot-sdk/index.js spawns index.js; helper contains network access plus dynamic code execution. L839: /** L840: * To be kept private to fire an event to L841: * subscribers ... L1377: try { L1378: await this.writable.write(headers.join(""), "ascii"); L1379: return this.writable.write(data); ... L2890: fromString(value, encoding) { L2891: return Buffer.from(value, encoding); L2892: } ... L3058: var crypto_1 = __require("crypto"); L3059: var net_1 = __require("net"); L3060: var api_1 = require_api();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

copilot-sdk/index.jsView on unpkg · L839

copilotView file

•path = copilot kind = native_binary sizeBytes = 153333920 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

sdk/index.jsView file

•path = sdk/index.js kind = oversized_source_file sizeBytes = 2815595 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sdk/index.jsView on unpkg

app.jsView file

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 9089681 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

11 flagged

index.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

2

3/*---------------------------------------------------------------------------------------------

4 * Copyright (c) Microsoft Corporation. All rights reserved.

5 *--------------------------------------------------------------------------------------------*/

6import __module from "module";

7const require = __module.createRequire(import.meta.url);

8

9var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnProperty;var M=(e=>typeof require<"u"

10`)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs"

11`);let o=Er(r,"preloads",Pe),i=t(o);if(process.stderr.write(`[extension-fork] resolveBootstrapPath: localBootstrap=${o}, localExists=${i}

12`),i)return o}var xr=new Set(["--server","--headless","--acp","--embedded-host"]),Cr=new Set(["completion","help","init","login","mcp","plugin","update","version"

13`);throw new Error(`Native addon "${e}" not found for ${t}. Tried:

14${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne(e){try{return{ok:!0,value:Hr(e)}}catch(r){return{ok:!1,err:r}}}function Hr(e){return Or(Ar(import.meta.url))(e)}var v,He=Re.dirname(Rr(import.meta.url));function $e(){if(v){if(v.kind==="ok")return v.addon;throw v.error}try{let e=ke("cli-native",[He,Re.resolve(He,"..","native","cli")]);return v={kind:"ok",addon:e},e}catch(e){let r=e instanceof Error?e:new Error(`Failed to load cli-native addon: ${Ie(e)}`);throw v={ki ...

15`),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:r,body:t,signal:AbortSignal.timeout(3e4)})}catch{}process.exit(

16

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-darwin-x64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

preloads/extension_bootstrap.mjsView file

Lines 1-35javascript

1/*---------------------------------------------------------------------------------------------

2 * Copyright (c) Microsoft Corporation. All rights reserved.

3 *--------------------------------------------------------------------------------------------*/

4

5// Bootstrap script for extension subprocesses.

6// This is the fork target — it sets up the SDK resolver in-process,

7// then dynamically imports the user's extension via the EXTENSION_PATH env var.

8

9import Module from "node:module"

copilot-sdk/index.jsView file

Lines 819-859javascript

819 const result = {

820 dispose: () => {

821 if (!this._callbacks) {

822 return;

823 }

copilotView file

•path = copilot kind = native_binary sizeBytes = 153333920 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

prebuilds/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

sdk/index.jsView file

•path = sdk/index.js kind = oversized_source_file sizeBytes = 2815595 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sdk/index.jsView on unpkg

app.jsView file

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 9089681 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg