scanned 1 file(s), 2.54 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, alfajores-forno.celo-testnet.org, api.avax-test.network, api.avax.network, api.etherscan.io, api.goldsky.com, api.linea-goerli.build, api.lineascan.build, api.routescan.io, api.sequinstream.com, api.thegraph.com, app.example.com, app.goldsky.com, aws.amazon.com, base-mainnet.g.alchemy.com, bsc-dataseed.binance.org, cms.goldsky.com, compose.goldsky.com, console.aws.amazon.com, console.rockset.com, dev.goldsky.com, docs.aws.amazon.com, docs.goldsky.com, duckdb.org, ed5d915e0259fcddb2ab1ce5592040c3.r2.cloudflarestorage.com, edge.goldsky.com, erpc-proxy.erpc.svc.cluster.local, forno.celo.org, github.com, goldsky.com, install-turbo.goldsky.com, ipfs.network.thegraph.com, json-schema.org, my-webhook-endpoint.com, portal.sso, portal.sso-fips, pris.ly, raw.githubusercontent.com, react-native.canny.io, registry.npmjs.org, rpc.ankr.com, rpc.chapel.dev, rpc.clover.finance, rpc.fuse.io, rpc.gnosischain.com, rpc.public.zkevm-test.net, s3-fips.dualstack
1Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=nY.prototype.append.bind
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L1 1849${hj.default.bold(N_)}
L1850: `),!await pg({message:"Would you like me to install it for you?",initialValue:!0}))return!1;let t=Of();return t.start("Installing turbo..."),new Promise(r=>{let n=tJe?(0,Nfe.spawn)...
L1851: `)}function $fe(e){return new Promise(()=>{let t=(0,oJe.spawn)(mj,e,{stdio:"inherit",shell:!1,env:{...process.env,[Bfe]:"1",PKG_EXECPATH:""}});t.on("error",r=>{let n=r.code==="ENOE...
5`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=nY.prototype.append.bind(this);if((typeo...
L8: `).join(`
...
L13: `),U=U.replace(/\\r/g,"\r")),S[O]=U}return S}function u(g){console.log(`[dotenv@${o}][DEBUG] ${g}`)}function p(g){return g[0]==="~"?n.join(i.homedir(),g.slice(1)):g}function d(g){l...
L14: `);return t.length<e?t:t
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L5 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
`).map(t=>t.trim()).join(" ")};s0e.O=function(e){return this.inspectOpts.colors=this.useColors,wM.inspect(e,this.inspectOpts)}});var a0e=D((mjr,xY)=>{typeof process>"u"||process.ty...
${e}`,A(t,!0)),this.name="RequestError",this.code="P5010"}};w(kr,"RequestError");async function ct(e,t,r=n=>n){let n=t.clientVersion;try{return typeof fetch=="function"?await r(fet...
/// API keys (\`EDGE_API_KEY_ENCRYPTION_KEY\`), never returned by any route;
`,inlineSchemaHash:"[redacted]",copyEngine:!0},Gxe=require("fs");px.dirname=__dirname;if(!Gxe.existsSync(dx.join(__dirname,"sc...
`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 1"use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=nY.prototype.append.bind(this);if((typeo...
...
L13: `),U=U.replace(/\\r/g,"\r")
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L1 1"use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};yme.exports={stringReplaceAll:uQe,stringEncaseCRLFWithFirstIndex:pQe}});var Eme=D((c_r,vme)=>{"use strict";var dQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="appli
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L1 1"use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};yme.exports={stringReplaceAll:uQe,stringEncaseCRLFWithFirstIndex:pQe}});var Eme=D((c_r,vme)=>{"use strict";var dQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="appli
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/index.jsView on unpkg · L1 1"use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};yme.exports={stringReplaceAll:uQe,stringEncaseCRLFWithFirstIndex:pQe}});var Eme=D((c_r,vme)=>{"use strict";var dQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="appli
HighObfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L1 1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js
L1: "use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});va
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L1 1"use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};yme.exports={stringReplaceAll:uQe,stringEncaseCRLFWithFirstIndex:pQe}});var Eme=D((c_r,vme)=>{"use strict";var dQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function _me(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Ame=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="appli
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1