1import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun...
L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let...
...
L82: `:`
L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){...
L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(`
...
L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(`
L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.mjsView on unpkg · L1 1Trigger-reachable chain: manifest.exports -> dist/index.mjs
L1: import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun...
L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let...
...
L82: `:`
L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){...
L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(`
...
L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(`
L116: `,e)+1}return{type
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L1 419causes have become circular...`;let o=r(e);return o?(t.add(e),a+`
L420: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct...
L421: `:`
406`),t,f,d.startLine-1,d);d.children=r,c=c.concat(r[mG.flatTokensSymbol])}}else o===`exit`&&(g===`htmlFlow`&&(m=!1),m||(a&&(Object.freeze(d.children),Object.freeze(d)),d=u.pop()))}re...
L407: `,editColumn:r.length+1})}};function OG(e){switch(e[0]){case`~`:return`tilde`;default:return`backtick`}}var kG={names:[`MD048`,`code-fence-style`],description:`Code fence style`,ta...
L408: `)],d);let{effectiveConfig:_,rulesEnabled:v,rulesSeverity:y}=tq(e,i,o),b=[...v.keys()];return s=new Map(v),c=s,u(t,p),u(t,m,h),u(t,g),{effectiveConfig:_,enabledRulesPerLineNumber:l...
...
L417: `],o,s=0;s<this.diffs.length;s++){switch(this.diffs[s][0]){case i:o=`+`;break;case r:o=`-`;break;case a:o=` `;break}n[s+1]=o+encodeURI(this.diffs[s][1])+`
L418: `}return n.join(``).replace(/%20/g,` `)},t.exports=n,t.expo
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L406 404`:a>=n?`\r
L405: `:`\r`,s}t.exports.getPreferredLineEnding=E;function D(e,t){let n=t&&t.homedir&&t.homedir();return n?e.replace(/^~($|\/|\\)/,`${n}$1`):e}t.exports.expandTildePath=D;function O(e){l...
L406: `),t,f,d.startLine-1,d);d.children=r,c=c.concat(r[mG.flatTokensSymbol])}}else o===`exit`&&(g===`htmlFlow`&&(m=!1),m||(a&&(Object.freeze(d.children),Object.freeze(d)),d=u.pop()))}re...
L407: `,editColumn:r.length+1})}};function OG(e){switch(e[0]){case`~`:return`tilde`;default:return`backtick`}}var kG={names:[`MD048`,`code-fence-style`],description:`Code fence style`,ta...
L408: `)],d);let{effectiveConfig:_,rulesEnabled:v,rulesSeverity:y}=tq(e,i,o),b=[...v.keys()];return s=new Map(v),c=s,u(t,p),u(t,m,h),u(t,g),{effectiveConfig:_,enabledRulesPerLineNumber:l...
...
L417: `],o,s=0;s<th
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.mjsView on unpkg · L404 1Cross-file remote execution chain: dist/index.mjs spawns dist/chunk-5QMZ5MUS-C5NTf5Rj.mjs; helper contains network access plus dynamic code execution.
L1: import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun...
L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let...
...
L82: `:`
L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){...
L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(`
...
L115: `)+1
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.mjsView on unpkg · L1 1Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs
L1: import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun...
L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let...
...
L82: `:`
L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){...
L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(`
...
L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(`
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.mjsView on unpkg · L1 404Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/index.mjs
L404: `:a>=n?`\r
L405: `:`\r`,s}t.exports.getPreferredLineEnding=E;function D(e,t){let n=t&&t.homedir&&t.homedir();return n?e.replace(/^~($|\/|\\)/,`${n}$1`):e}t.exports.expandTildePath=D;function O(e){l...
L406: `),t,f,d.startLine-1,d);d.children=r,c=c.concat(r[mG.flatTokensSymbol])}}else o===`exit`&&(g===`htmlFlow`&&(m=!1),m||(a&&(Object.freeze(d.children),Object.freeze(d)),d=u.pop()))}re...
L407: `,editColumn:r.length+1})}};function OG(e){switch(e[0]){case`~`:return`tilde`;default:return`backtick`}}var kG={names:[`MD048`,`code-fence-style`],description:`Code fence style`,ta...
L408: `)],d);let{effectiveConfig:_,rulesEnabled:v,rulesSeverity:y}=tq(e,i,o),b=[...v.keys()];return s=new Map(v),c=s,u(t,p),u
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.mjsView on unpkg · L404