187Previous: %s
L188: Incoming: %s`,zc,"["+E.join(", ")+"]","["+T.join(", ")+"]");for(var F=0;F<T.length&&F<E.length;F++)if(!nh(E[F],T[F]))return!1;return!0}i(ah,"areHookInputsEqual");function yb(){if(f...
L189: Error generating stack: `+Y.message+`
L190: `+Y.stack}}i(dh,"getStackByComponentStackNode");var xd=n.ReactCurrentDispatcher,Is=n.ReactDebugCurrentFrame,H0=0,Rl=1,ph=2,Rb=3,mh=4,Hc=0,Nb=1,Vc=2,Ad=12800;function Ob(E){return c...
L191: `));if(!v)return null;It=bt(v,!0)}return It.shift()},"FS_stdin_getChar"),Bt={ttys:[],init(){},shutdown(){},register(v,D){Bt.ttys[v]={input:[],output:[],ops:D},B.registerDevice(v,Bt...
...
L201: ${t.link} ${C4(e)}`),x4("WARN ",e,t.short)}function yn(...e){let t=T4(2,"error");process.stderr.write(`
L202: ${t.link} ${C4(e)}`),x4("ERROR",e,t.short)}fun
CriticalSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
server/WebServer.mjsView on unpkg · L187 1Source sends the broad process environment to a literal external destination.
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return nE(e.na...
L6
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
server/WebServer.mjsView on unpkg · L1 1Trigger-reachable chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("This is not an
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
server/WebServer.mjsView on unpkg · L1 201${t.link} ${C4(e)}`),x4("WARN ",e,t.short)}function yn(...e){let t=T4(2,"error");process.stderr.write(`
L202: ${t.link} ${C4(e)}`),x4("ERROR",e,t.short)}function Za(...e){let t=T4(2,"debug");x4("DEBUG",e,t.short)}var az,M4e,Zg,HC,U4e,wi=se(()=>{i(T4,"callerLocation");az={info:"\x1B[32m",de...
L203: `).slice(0,3).join(`
187Previous: %s
L188: Incoming: %s`,zc,"["+E.join(", ")+"]","["+T.join(", ")+"]");for(var F=0;F<T.length&&F<E.length;F++)if(!nh(E[F],T[F]))return!1;return!0}i(ah,"areHookInputsEqual");function yb(){if(f...
L189: Error generating stack: `+Y.message+`
L190: `+Y.stack}}i(dh,"getStackByComponentStackNode");var xd=n.ReactCurrentDispatcher,Is=n.ReactDebugCurrentFrame,H0=0,Rl=1,ph=2,Rb=3,mh=4,Hc=0,Nb=1,Vc=2,Ad=12800;function Ob(E){return c...
L191: `));if(!v)return null;It=bt(v,!0)}return It.shift()},"FS_stdin_getChar"),Bt={ttys:[],init(){},shutdown(){},register(v,D){Bt.ttys[v]={input:[],output:[],ops:D},B.registerDevice(v,Bt...
...
L201: ${t.link} ${C4(e)}`),x4("WARN ",e,t.short)}function yn(...e){let t=T4(2,"error");process.stderr.write(`
L202: ${t.link} ${C4(e)}`),x4("ERROR",e,t.short)}fun
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
server/WebServer.mjsView on unpkg · L187 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return nE(e.na...
L6
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
server/WebServer.mjsView on unpkg · L1 1Trigger-reachable credential exfiltration chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw ne
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
server/WebServer.mjsView on unpkg · L1 187Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs
L187: Previous: %s
L188: Incoming: %s`,zc,"["+E.join(", ")+"]","["+T.join(", ")+"]");for(var F=0;F<T.length&&F<E.length;F++)if(!nh(E[F],T[F]))return!1;return!0}i(ah,"areHookInputsEqual");function yb(){if(f...
L189: Error generating stack: `+Y.message+`
L190: `+Y.stack}}i(dh,"getStackByComponentStackNode");var xd=n.ReactCurrentDispatcher,Is=n.ReactDebugCurrentFrame,H0=0,Rl=1,ph=2,Rb=3,mh=4,Hc=0,Nb=1,Vc=2,Ad=12800;function Ob(E){return c...
L191: `));if(!v)return null;It=bt(v,!0)}return It.shift()},"FS_stdin_getChar"),Bt={ttys:[],init(){},shutdown(){},register(v,D){Bt.ttys[v]={input:[],output:[],ops:D},B.registerDevice(v,Bt...
...
L201: ${t.link} ${C4(e)}`),x4("WARN ",e,t.short)}function yn(...e){let
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
server/WebServer.mjsView on unpkg · L187 1Trigger-reachable persistence chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("Thi
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return nE(e.na...
L6
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var zie=Object.create;var jb=Object.defineProperty;var Gie=Object.getOwnPropertyDescriptor;var Hie=Object.getOwnPropertyNames;var Vie=Object.getPrototypeOf,qie=Object.prototype.has...
L3: `+OR(t,r.offset));let n=pm(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+OR(t,a.offset,a.len))}return n.value}function OR(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function FR(e){return Foe(W3,e)}function as(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return nE(e.na...
L6
LowWeak Crypto
Package source references weak cryptographic algorithms.
server/WebServer.mjsView on unpkg · L1