@github/copilot-darwin-x64@1.0.73: Suspicious npm security report

Loading npm security reports…

@github/copilot-darwin-x64@1.0.73: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged

index.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

3/*---------------------------------------------------------------------------------------------

5 *--------------------------------------------------------------------------------------------*/

6import __module from "module";

7const require = __module.createRequire(import.meta.url);

9var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnProperty;var M=(e=>typeof require<"u"

10`)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs"

11`);let o=Er(r,"preloads",Pe),i=t(o);if(process.stderr.write(`[extension-fork] resolveBootstrapPath: localBootstrap=${o}, localExists=${i}

12`),i)return o}var xr=new Set(["--server","--headless","--acp","--embedded-host"]),Cr=new Set(["completion","help","init","login","mcp","plugin","update","version"

13`);throw new Error(`Native addon "${e}" not found for ${t}. Tried:

14${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne(e){try{return{ok:!0,value:Hr(e)}}catch(r){return{ok:!1,err:r}}}function Hr(e){return Or(Ar(import.meta.url))(e)}var v,He=Re.dirname(Rr(import.meta.url));function $e(){if(v){if(v.kind==="ok")return v.addon;throw v.error}try{let e=ke("cli-native",[He,Re.resolve(He,"..","native","cli")]);return v={kind:"ok",addon:e},e}catch(e){let r=e instanceof Error?e:new Error(`Failed to load cli-native addon: ${Ie(e)}`);throw v={ki ...

15`),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:r,body:t,signal:AbortSignal.timeout(3e4)})}catch{}process.exit(

Long lines were clipped for display.

sdk/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-darwin-x64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/index.jsView on unpkg

87`&&(e="normal");break;case"blockComment":s==="*"&&o==="/"&&(r++,e="normal");break;case"normal":if(s==="'")n??=r,e="single";else if(s==='"')n??=r,e="double";else if(s==="`")n??=r,e=... L88: `||t==="\v"||t==="\f"||t==="\r"||t===" "||t==="\uFEFF"}function MAe(t){return t!==void 0&&/\s/u.test(t)}function OAe(t){if(!t.startsWith(`${_6}:`))return;let e=t.slice(_6.length+1)... L89: ${a.stderr}`:l,u=new Error(c);throw u.name=a.errorName??"Error",u.code=a.errorCode??a.exitCode,u.killed=a.killed,u.signal=a.signal??null,u.cmd=a.command,u.stdout=a.stdout,u.stderr=...

High

Shell

Package source references shell execution.

sdk/index.jsView on unpkg · L87

59const __esmShimDirname = __path.dirname(__esmShimFilename); L60: var twe=Object.create;var tM=Object.defineProperty;var nwe=Object.getOwnPropertyDescriptor;var rwe=Object.getOwnPropertyNames;var swe=Object.getPrototypeOf,owe=Object.prototype.has... L61: `);throw new Error(`Native addon "${t}" not found for ${n}. Tried: ... L105: \`\`\``)}async function BOe(t,e,n){let r=UOe(t,{encoding:"utf8"}),s=[],o=1,i="",a=!1,l=()=>{if(o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),o>=n)return{lines:s,lastLineRead:o,reac... L106: `){let g=l();if(g)return g;continue}o>=e&&o<=n&&(i.length<HOe?i+=m:a=!0)}}return o>=e&&o<=n&&s.push(a?`${i}... (truncated)`:i),{lines:s,lastLineRead:o,reachedEOF:!0}}function c8(t)... L107: Here is a potentially relevant text excerpt in \`${T}\` starting at line ${E}:`),y.p

preloads/extension_bootstrap.mjsView file

Lines 1-35javascript

1/*---------------------------------------------------------------------------------------------

3 *--------------------------------------------------------------------------------------------*/

5// Bootstrap script for extension subprocesses.

6// This is the fork target — it sets up the SDK resolver in-process,

7// then dynamically imports the user's extension via the EXTENSION_PATH env var.

9import Module from "node:module"

copilot-sdk/index.jsView file

Lines 831-871javascript

831 const result = {

832 dispose: () => {

833 if (!this._callbacks) {

834 return;

835 }

copilotView file

•path = copilot kind = native_binary sizeBytes = 164244224 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

13 flagged · loading source

index.jsView file

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function kr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ne... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L8

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L8

sdk/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/index.jsView on unpkg

High

Shell

Package source references shell execution.

sdk/index.jsView on unpkg · L87

preloads/extension_bootstrap.mjsView file

15// Register a CJS require hook so that CommonJS extensions can L16: // `require("@github/copilot-sdk")` and have it resolve to the bundled SDK. L17: const sdkPath = process.env.COPILOT_SDK_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preloads/extension_bootstrap.mjsView on unpkg · L15

copilot-sdk/index.jsView file

851Cross-file remote execution chain: copilot-sdk/index.js spawns index.js; helper contains network access plus dynamic code execution. L851: /** L852: * To be kept private to fire an event to L853: * subscribers ... L1389: try { L1390: await this.writable.write(headers.join(""), "ascii"); L1391: return this.writable.write(data); ... L2902: fromString(value, encoding) { L2903: return Buffer.from(value, encoding); L2904: } ... L3070: var crypto_1 = __require("crypto"); L3071: var net_1 = __require("net"); L3072: var api_1 = require_api();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

copilot-sdk/index.jsView on unpkg · L851

copilotView file

•path = copilot kind = native_binary sizeBytes = 164244224 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

13 flagged

index.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

3/*---------------------------------------------------------------------------------------------

5 *--------------------------------------------------------------------------------------------*/

6import __module from "module";

7const require = __module.createRequire(import.meta.url);

10`)}else s.length>0&&(t=N(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as Er}from"node:path";var Pe="extension_bootstrap.mjs"

11`);let o=Er(r,"preloads",Pe),i=t(o);if(process.stderr.write(`[extension-fork] resolveBootstrapPath: localBootstrap=${o}, localExists=${i}

12`),i)return o}var xr=new Set(["--server","--headless","--acp","--embedded-host"]),Cr=new Set(["completion","help","init","login","mcp","plugin","update","version"

13`);throw new Error(`Native addon "${e}" not found for ${t}. Tried:

Long lines were clipped for display.

sdk/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdk/index.jsView on unpkg

High

Shell

Package source references shell execution.

sdk/index.jsView on unpkg · L87

preloads/extension_bootstrap.mjsView file

Lines 1-35javascript

1/*---------------------------------------------------------------------------------------------

3 *--------------------------------------------------------------------------------------------*/

5// Bootstrap script for extension subprocesses.

6// This is the fork target — it sets up the SDK resolver in-process,

7// then dynamically imports the user's extension via the EXTENSION_PATH env var.

9import Module from "node:module"

copilot-sdk/index.jsView file

Lines 831-871javascript

831 const result = {

832 dispose: () => {

833 if (!this._callbacks) {

834 return;

835 }

copilotView file

•path = copilot kind = native_binary sizeBytes = 164244224 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView file

•path = builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icns kind = high_entropy_blob sizeBytes = 559537 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

builtin-plugins/computer-use/0.1.71/darwin-x64/Copilot Computer Use.app/Contents/Resources/icon.icnsView on unpkg

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8938391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

@github/copilot-darwin-x64@1.0.73

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code