364distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues)
L365: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_...
L366: `).slice(0,3).join(`
CriticalSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
server/WebServer.mjsView on unpkg · L364 1Source sends the broad process environment to a literal external destination.
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw new Error("
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return h6(e.na...
L6
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return h6(e.na...
L6
CriticalBrowser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
server/WebServer.mjsView on unpkg · L1 1Trigger-reachable chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw new Error("This is not an
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
server/WebServer.mjsView on unpkg · L1 •matchType = previous_version_dangerous_delta
matchedPackage = @knockdata/objectexplorer@0.6.6
matchedIdentity = npm:[redacted]:0.6.6
similarity = 0.839
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
server/WebServer.mjsView on unpkg 364distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues)
L365: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_...
L366: `).slice(0,3).join(`
HighChild Process
Package source references child process execution.
server/WebServer.mjsView on unpkg · L364 364distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues)
L365: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_...
L366: `).slice(0,3).join(`
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
server/WebServer.mjs:
`),"blockTransform")})}function SR(e,t){if(!t)return e;let r=typeof t[0]=="string"?t[0]:"[",n=typeof t[1]=="string"?t[1]:"]";return r+e+n}function GH(e,t,r,n,a){let o=typeof t=="fu...
`);n.next.cells.push({colspan:t,rowspan:r,text:a})}closeTableRow(){let t=this._popStackItem();t.next.rows.push(t.cells)}closeTable({tableToString:t,leadingLineBreaks:r=2,trailingLi...
`+K.stack}}i(cb,"getStackByComponentStackNode");var im=n.ReactCurrentDispatcher,ic=n.ReactDebugCurrentFrame,Xh=0,bu=1,ub=2,$4=3,db=4,Qd=0,G4=1,Xd=2,om=12800;function H4(E){return c...
`));if(!y)return null;xe=We(y,!0)}return xe.shift()},"FS_stdin_getCha
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
server/WebServer.mjsView on unpkg 364distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues)
L365: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_...
L366: `).slice(0,3).join(`
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
server/WebServer.mjsView on unpkg · L364 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return h6(e.na...
L6
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
server/WebServer.mjsView on unpkg · L1 10`).map(o=>"> "+o).join(`
L11: `),"blockTransform")})}function SR(e,t){if(!t)return e;let r=typeof t[0]=="string"?t[0]:"[",n=typeof t[1]=="string"?t[1]:"]";return r+e+n}function GH(e,t,r,n,a){let o=typeof t=="fu...
L12: `)}splitLongWord(t){let r=[],n=0;for(;t.length>this.maxLineLength;){let a=t.substring(0,this.maxLineLength),o=t.substring(this.maxLineLength),s=a.lastIndexOf(this.wrapCharacters[n]...
...
L189: Error generating stack: `+K.message+`
L190: `+K.stack}}i(cb,"getStackByComponentStackNode");var im=n.ReactCurrentDispatcher,ic=n.ReactDebugCurrentFrame,Xh=0,bu=1,ub=2,$4=3,db=4,Qd=0,G4=1,Xd=2,om=12800;function H4(E){return c...
L191: `));if(!y)return null;xe=We(y,!0)}return xe.shift()},"FS_stdin_getChar"),ot={ttys:[],init(){},shutdown(){},register(y,O){ot.ttys[y]={input:[],output
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
server/WebServer.mjsView on unpkg · L10 1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution.
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
server/WebServer.mjsView on unpkg · L1 1Trigger-reachable credential exfiltration chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var B4e=Object.create;var i6=Object.defineProperty;var U4e=Object.getOwnPropertyDescriptor;var z4e=Object.getOwnPropertyNames;var $4e=Object.getPrototypeOf,G4e=Object.prototype.has...
L3: `+zG(t,r.offset));let n=S1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi...
L4: `+zG(t,a.offset,a.len))}return n.value}function zG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L5: ${"".padEnd(t)}${"^".repeat(r)}`}function jG(e){return L6e(jA,e)}function cl(e){if(!e.type)throw ne
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
server/WebServer.mjsView on unpkg · L1 364Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs
L364: distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues)
L365: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_...
L366: `).slice(0,3).join(`
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
server/WebServer.mjsView on unpkg · L364