registry / @jacksondr5/j5code / 0.0.40
@jacksondr5/j5code@0.0.40
⚠ Under reviewAI Security Review
scanned 4d ago · by lpm-firewall-aiThe package manifest points the `j5` command to `dist/bin.mjs`, but reads of that file failed with a binary/NUL error. The reviewed child-process and Unicode matches appear consistent with the package’s CLI and text-rendering functions, but they do not resolve what the unreadable entrypoint does.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running the installed `j5` command.
Impact
Unknown; no concrete malicious action was confirmed.
Mechanism
The declared entrypoint, `dist/bin.mjs`, could not be read; adjacent readable bundles show process and PTY support but do not establish the CLI’s behavior.
AI rationale
The package manifest points the `j5` command to `dist/bin.mjs`, but reads of that file failed with a binary/NUL error. The reviewed child-process and Unicode matches appear consistent with the package’s CLI and text-rendering functions, but they do not resolve what the unreadable entrypoint does.
Evidence
dist/bin.mjs
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with high false-positive risk.
AI review observations
- The manifest declares `j5` as a CLI backed by `dist/bin.mjs`.
- The flagged child-process code spawns a supplied command through a process service.
- The confirmed invisible-character match is a zero-width space in a text-spacing fallback next to Unicode character ranges.
Evidence against
- Reads of `dist/bin.mjs` returned “Binary or unapproved NUL source file,” so its CLI behavior could not be inspected.
- The readable process and PTY code is consistent with terminal and process support for a coding-agent CLI.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
10 flaggeddist/NodeServices-D2A6tYeN.mjsView file
6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa...
L7: import * as NodeChildProcess from "node:child_process";
L8: import { PassThrough } from "node:stream";
High
Child Process
Package source references child process execution.
dist/NodeServices-D2A6tYeN.mjsView on unpkg · L66Cross-file remote execution chain: dist/NodeServices-D2A6tYeN.mjs spawns dist/Schema-jqAifT37.mjs; helper contains network access plus dynamic code execution.
L6: import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa...
L7: import * as NodeChildProcess from "node:child_process";
L8: import { PassThrough } from "node:stream";
...
L226: * operating-system processes. A spawner turns a command description into a
L227: * handle that can write to stdin, read stdout and stderr, wait for exit, kill
L228: * the process, and manage whether the process keeps its parent alive. Platform
...
L581: return callback(function loop(resume) {
L582: for (; i < chunk.length;) if (!optio
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/NodeServices-D2A6tYeN.mjsView on unpkg · L6Findings
1 Critical5 High7 Medium5 Low
CriticalTrojan Source Unicodedist/client/assets/ComposerPromptEditor-CeGErA5L.js
HighChild Processdist/NodeServices-D2A6tYeN.mjs
HighShell
HighCross File Remote Execution Contextdist/NodeServices-D2A6tYeN.mjs
HighKnown Malware Source Similaritydist/NodePtyAdapter-DgsthENb.mjs
HighKnown Malware Source Similaritydist/BunPtyAdapter-BRG4gp4_.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/resource-monitor/darwin-x64/t3-resource-monitor
MediumShips Wasm Moduledist/client/assets/ghostty-vt-DdA0Zryv.wasm
MediumOversized Source Filedist/bin.mjs
MediumOversized Cli Entrypoint
Affected versions and remediation
This report applies to @jacksondr5/j5code@0.0.40.
See all versions of @jacksondr5/j5code for other recorded verdicts.
- Review the evidence and your use of @jacksondr5/j5code@0.0.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.