registry / @github/copilot-linux-arm64 / 1.0.69

@github/copilot-linux-arm64@1.0.69

⚠ Under review

GitHub Copilot CLI for linux-arm64

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 14 file(s), 1.47 MB of source, external domains: aka.ms, api.anthropic.com, api.github.com, collector.example.com, collector.internal, docs.github.com, example.com, github.com, malicious-site.com, mcp.notion.com, mcp.stripe.com, my-api.example.com, my-resource.openai.azure.com, no-color.org, proxy.corp.example, proxy.example.com

Oversized source lightweight scan

app.js8.13 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsNativeBindingsHighEntropyStringsUrlStringsapi.anthropic.comapi.github.comcollector.example.comcollector.internaldocs.github.comexample.comgithub.commalicious-site.commcp.notion.commcp.stripe.commy-api.example.commy-resource.openai.azure.comno-color.orgproxy.corp.exampleproxy.example.com

sdk/index.js2.86 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsNativeBindingsObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com

Source & flagged code

10 flagged

index.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

3/*---------------------------------------------------------------------------------------------

5 *--------------------------------------------------------------------------------------------*/

6import __module from "module";

7const require = __module.createRequire(import.meta.url);

9var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnProperty;var M=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(r,t)=>

10`)}else s.length>0&&(t=A(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as xr}from"node:path";var Pe="extension_bootstrap.mjs";function Te(e,r,t=br){let n=

11`);let o=xr(r,"preloads",Pe),i=t(o);if(process.stderr.write(`[extension-fork] resolveBootstrapPath: localBootstrap=${o}, localExists=${i}

12`),i)return o}var Er=new Set(["--server","--headless","--acp","--embedded-host"]),Cr=new Set(["completion","help","init","login","mcp","plugin","update","version"]);function Lr(e){return e==="--prompt"||e.startsWith(

13`);throw new Error(`Native addon "${e}" not found for ${t}. Tried:

14${s}`)}function Hr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ae(e){try{return{ok:!0,value:Rr(e)}}catch(r){return{ok:!1,err:r}}}function Rr(e){return Or(Nr(import.meta.url))(e)}var v,Re=ke.dirname(kr(import.meta.url));function De(){if(v){if(v.kind==="ok")return v.addon;throw v.error}try{let e=He("cli-native",[Re,ke.resolve(Re,"..","native","cli")]);return v={kind:"ok",addon:e},e}catch(e){let r=e instanceof Error?e:new Error(`Failed to load cli-native addon: ${Ie(e)}`);throw v={ki ...

15`),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:r,body:t,signal:AbortSignal.timeout(3e4)})}catch{}process.exit(0)}else{Oe(process.argv.slice(2))&&we.start();let e=await Se(k,Vr);await import

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @github/copilot-linux-arm64@1.0.68 matchedIdentity = npm:[redacted]:1.0.68 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

preloads/extension_bootstrap.mjsView file

Lines 1-35javascript

1/*---------------------------------------------------------------------------------------------

3 *--------------------------------------------------------------------------------------------*/

5// Bootstrap script for extension subprocesses.

6// This is the fork target — it sets up the SDK resolver in-process,

7// then dynamically imports the user's extension via the EXTENSION_PATH env var.

9import Module from "node:module";

10import { resolve

copilot-sdk/index.jsView file

Lines 819-859javascript

819 const result = {

820 dispose: () => {

821 if (!this._callbacks) {

822 return;

823 }

824 this._callbacks.remove(listener, thisArgs);

copilotView file

•path = copilot kind = native_binary sizeBytes = 149162752 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

sdk/index.jsView file

•path = sdk/index.js kind = oversized_source_file sizeBytes = 3001334 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sdk/index.jsView on unpkg

app.jsView file

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8525625 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

10 flagged · loading source

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L8

8L9: var Ve=Object.create;var B=Object.defineProperty;var Ue=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,qe=Object.prototype.hasOwnPro... L10: `)}else s.length>0&&(t=A(s[0],"app.js"))}return t}import{existsSync as br}from"node:fs";import{basename as vr,resolve as xr}from"node:path";var Pe="extension_bootstrap.mjs";functio... ... L14: ${s}`)}function Hr(e){if(e instanceof Error)return e.message;if(typeof e=="string")return e;try{return JSON.stringify(e)}catch{return Object.prototype.toString.call(e)}}function Ae... L15: `),process.exit(1)}}else if(process.env.COPILOT_SHUTDOWN_FLUSH){try{let{url:e,headers:r,body:t}=JSON.parse(process.env.COPILOT_SHUTDOWN_FLUSH);await fetch(e,{method:"POST",headers:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L8

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L8

preloads/extension_bootstrap.mjsView file

15// Register a CJS require hook so that CommonJS extensions can L16: // `require("@github/copilot-sdk")` and have it resolve to the bundled SDK. L17: const sdkPath = process.env.COPILOT_SDK_PATH;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preloads/extension_bootstrap.mjsView on unpkg · L15

copilot-sdk/index.jsView file

839Cross-file remote execution chain: copilot-sdk/index.js spawns index.js; helper contains network access plus dynamic code execution. L839: /** L840: * To be kept private to fire an event to L841: * subscribers ... L1377: try { L1378: await this.writable.write(headers.join(""), "ascii"); L1379: return this.writable.write(data); ... L2890: fromString(value, encoding) { L2891: return Buffer.from(value, encoding); L2892: } ... L3058: var crypto_1 = __require("crypto"); L3059: var net_1 = __require("net"); L3060: var api_1 = require_api();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

copilot-sdk/index.jsView on unpkg · L839

copilotView file

•path = copilot kind = native_binary sizeBytes = 149162752 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

sdk/index.jsView file

•path = sdk/index.js kind = oversized_source_file sizeBytes = 3001334 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sdk/index.jsView on unpkg

app.jsView file

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8525625 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Findings

1 Critical6 High7 Medium5 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processindex.js

HighShell

HighSame File Env Network Executionindex.js

HighCommand Output Exfiltrationindex.js

HighCross File Remote Execution Contextcopilot-sdk/index.js

HighOversized Source Filesdk/index.js

MediumDynamic Requirepreloads/extension_bootstrap.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarycopilot

MediumShips Wasm Moduletree-sitter-go.wasm

MediumOversized Cli Entrypointapp.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

10 flagged

index.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

3/*---------------------------------------------------------------------------------------------

5 *--------------------------------------------------------------------------------------------*/

6import __module from "module";

7const require = __module.createRequire(import.meta.url);

11`);let o=xr(r,"preloads",Pe),i=t(o);if(process.stderr.write(`[extension-fork] resolveBootstrapPath: localBootstrap=${o}, localExists=${i}

13`);throw new Error(`Native addon "${e}" not found for ${t}. Tried:

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

preloads/extension_bootstrap.mjsView file

Lines 1-35javascript

1/*---------------------------------------------------------------------------------------------

3 *--------------------------------------------------------------------------------------------*/

5// Bootstrap script for extension subprocesses.

6// This is the fork target — it sets up the SDK resolver in-process,

7// then dynamically imports the user's extension via the EXTENSION_PATH env var.

9import Module from "node:module";

10import { resolve

copilot-sdk/index.jsView file

Lines 819-859javascript

819 const result = {

820 dispose: () => {

821 if (!this._callbacks) {

822 return;

823 }

824 this._callbacks.remove(listener, thisArgs);

copilotView file

•path = copilot kind = native_binary sizeBytes = 149162752 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

copilotView on unpkg

tree-sitter-go.wasmView file

•path = tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-go.wasmView on unpkg

sdk/index.jsView file

•path = sdk/index.js kind = oversized_source_file sizeBytes = 3001334 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

sdk/index.jsView on unpkg

app.jsView file

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 8525625 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg