registry / @jacksondr5/j5code / 0.0.39
@jacksondr5/j5code@0.0.39
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a CLI application with terminal and process execution support, and the reviewed code ties those operations to configured commands. The scanner hints did not establish an unrelated credential transfer, automatic attack, or concealed payload.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The `j5` CLI is invoked; process and terminal operations occur as part of its application behavior.
Impact
No malicious impact was identified.
Mechanism
The reviewed process service runs configured commands and the terminal adapter locates the installed node-pty helper. No unrelated collection or concealed execution was established.
AI rationale
The package is a CLI application with terminal and process execution support, and the reviewed code ties those operations to configured commands. The scanner hints did not establish an unrelated credential transfer, automatic attack, or concealed payload.
Evidence
dist/bin.mjsdist/NodeServices-D2A6tYeN.mjsdist/NodePtyAdapter-DgsthENb.mjs
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a `j5` CLI entrypoint and lists no install lifecycle scripts.
- The process service spawns the command and arguments supplied to it, passing its configured options.
- The terminal adapter resolves the `node-pty` helper from the installed `node-pty` package.
Evidence against
- Process execution and terminal support fit the package’s CLI purpose; the reviewed code does not show an unrelated command or automatic payload execution.
- The credential host pointers are in the Claude Agent SDK dependency and do not establish that this package sends credentials to an unrelated host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
10 flaggeddist/NodeServices-D2A6tYeN.mjsView file
6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa...
L7: import * as NodeChildProcess from "node:child_process";
L8: import { PassThrough } from "node:stream";
High
Child Process
Package source references child process execution.
dist/NodeServices-D2A6tYeN.mjsView on unpkg · L66Cross-file remote execution chain: dist/NodeServices-D2A6tYeN.mjs spawns dist/Schema-jqAifT37.mjs; helper contains network access plus dynamic code execution.
L6: import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa...
L7: import * as NodeChildProcess from "node:child_process";
L8: import { PassThrough } from "node:stream";
...
L226: * operating-system processes. A spawner turns a command description into a
L227: * handle that can write to stdin, read stdout and stderr, wait for exit, kill
L228: * the process, and manage whether the process keeps its parent alive. Platform
...
L581: return callback(function loop(resume) {
L582: for (; i < chunk.length;) if (!optio
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/NodeServices-D2A6tYeN.mjsView on unpkg · L6Findings
1 Critical5 High7 Medium5 Low
CriticalTrojan Source Unicodedist/client/assets/ComposerPromptEditor-DQ6d7qzC.js
HighChild Processdist/NodeServices-D2A6tYeN.mjs
HighShell
HighCross File Remote Execution Contextdist/NodeServices-D2A6tYeN.mjs
HighKnown Malware Source Similaritydist/NodePtyAdapter-DgsthENb.mjs
HighKnown Malware Source Similaritydist/BunPtyAdapter-BRG4gp4_.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/resource-monitor/darwin-x64/t3-resource-monitor
MediumShips Wasm Moduledist/client/assets/ghostty-vt-DdA0Zryv.wasm
MediumOversized Source Filedist/bin.mjs
MediumOversized Cli Entrypoint
Affected versions and remediation
This report applies to @jacksondr5/j5code@0.0.39.
See all versions of @jacksondr5/j5code for other recorded verdicts.
- Review the evidence and your use of @jacksondr5/j5code@0.0.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.