9__commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
cli.jsView on unpkg · L9 9__commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
CriticalClipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
cli.jsView on unpkg · L9 9__commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
CriticalRemote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
cli.jsView on unpkg · L9 9Trigger-reachable chain: manifest.main -> cli.js
L9: __commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
cli.jsView on unpkg · L9 •matchType = previous_version_dangerous_delta
matchedPackage = @gobi-starweaver/ws-cli@0.4.2
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.4.2
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli.jsView on unpkg 57836const systemRoot = env5.SystemRoot ?? "C:\\Windows";
L57837: const powershell = path6.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
L57838: const mediaDir = path6.win32.join(systemRoot, "Media");
9Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network, clipboard-hijack, builtin-tampering
L9: __commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
HighEntrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
cli.jsView on unpkg · L9 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
cli.js:
"Authorization",
"Proxy-Authorization",
get baseUrl() {
return this.baseUrl?.origin;
this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`;
this[kProxyHeaders]["proxy-authorization"] = opts.token;
this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;
const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
cli.jsView on unpkg 9__commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
cli.jsView on unpkg · L9 9__commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
HighObfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
cli.jsView on unpkg · L9 9Cross-file remote execution chain: cli.js spawns chunks/devtools-V5WI5QLO.js; helper contains network access plus dynamic code execution.
L9: __commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
cli.jsView on unpkg · L9 9Trigger-reachable credential exfiltration chain: manifest.main -> cli.js
L9: __commonJS,
L10: __dirname,
L11: __export,
...
L498: ];
L499: if (process.platform !== "win32") {
L500: module2.exports.push(
...
L647: }
L648: process24.exitCode = code || /* istanbul ignore next */
L649: 0;
...
L1023: function formatProdErrorMessage(code) {
L1024: var url2 = "https://react.dev/errors/" + code;
L1025: if (1 < arguments.length) {
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
cli.jsView on unpkg · L9 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
cli.jsView on unpkg 539} else {
L540: assert2 = __require("assert");
L541: signals = require_signals();
•path = cli.js
kind = oversized_source_file
sizeBytes = 6083130
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
cli.jsView on unpkg •path = cli.js
kind = oversized_cli_entrypoint
sizeBytes = 6083130
magicHex = [redacted]
MediumOversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
cli.jsView on unpkg