6Source sends the broad process environment to a literal external destination.
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
cli.jsView on unpkg · L6 6__commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli.jsView on unpkg · L6 6__commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
CriticalClipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
cli.jsView on unpkg · L6 6__commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
CriticalRemote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
cli.jsView on unpkg · L6 6Trigger-reachable chain: manifest.main -> cli.js
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
cli.jsView on unpkg · L6 •matchType = previous_version_dangerous_delta
matchedPackage = @gobi-starweaver/ws-cli@0.4.2
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.4.2
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli.jsView on unpkg 6Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network, clipboard-hijack, builtin-tampering
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
HighEntrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
cli.jsView on unpkg · L6 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
cli.js:
"Authorization",
"Proxy-Authorization",
get baseUrl() {
return this.baseUrl?.origin;
this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`;
this[kProxyHeaders]["proxy-authorization"] = opts.token;
this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;
const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
cli.jsView on unpkg 6__commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
cli.jsView on unpkg · L6 6__commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
HighObfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
cli.jsView on unpkg · L6 6Cross-file remote execution chain: cli.js spawns chunks/devtools-V5WI5QLO.js; helper contains network access plus dynamic code execution.
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
cli.jsView on unpkg · L6 6Trigger-reachable credential exfiltration chain: manifest.main -> cli.js
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
cli.jsView on unpkg · L6 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
cli.jsView on unpkg •matchType = normalized_sha256
matchedPackage = @gobi-starweaver/ws-cli@0.3.7
matchedPath = cli.js
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
cli.jsView on unpkg 536} else {
L537: assert2 = __require("assert");
L538: signals = require_signals();
•path = cli.js
kind = oversized_source_file
sizeBytes = 5961341
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
cli.jsView on unpkg •path = cli.js
kind = oversized_cli_entrypoint
sizeBytes = 5961341
magicHex = [redacted]
MediumOversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
cli.jsView on unpkg