1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var F5e=Object.create;var o6=Object.defineProperty;var B5e=Object.getOwnPropertyDescriptor;var U5e=Object.getOwnPropertyNames;var $5e=Object.getPrototypeOf,z5e=Object.prototype.has...
L3: `)}function dn(...e){let t=s6(2,"info");process.stderr.write(`
L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function Ln(...e){let t=s6(2,"warn");process.stderr.write(`
...
L8: `+mj(t,a.offset,a.len))}return n.value}function mj(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L9: ${"".padEnd(t)}${"^".repeat(r)}`}function Sj(e){return jxe(PD,e)}function Sl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return b6(e.na...
L10: `.repea
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
server/WebServer.mjsView on unpkg · L1 1Trigger-reachable chain: manifest.main -> server/WebServer.mjs
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var F5e=Object.create;var o6=Object.defineProperty;var B5e=Object.getOwnPropertyDescriptor;var U5e=Object.getOwnPropertyNames;var $5e=Object.getPrototypeOf,z5e=Object.prototype.has...
L3: `)}function dn(...e){let t=s6(2,"info");process.stderr.write(`
L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function Ln(...e){let t=s6(2,"warn");process.stderr.write(`
...
L8: `+mj(t,a.offset,a.len))}return n.value}function mj(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L9: ${"".padEnd(t)}${"^".repeat(r)}`}function Sj(e){return jxe(PD,e)}function Sl(e){if(!e.type)throw new Error("This is not an AST node."
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
server/WebServer.mjsView on unpkg · L1 480where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var vae,qC=ne(()=>{Ga();Wc();vae=300;i(_He,"slotOf");i(zC,"recordAccess");i(GC,"accessRollup")});import yae from"...
L481: on conflict (name) do update set value = excluded.value, setTs = excluded.setTs`,[e,String(t),Dr()])}var Cae=ne(()=>{Ga();i(Tae,"readSetting");i(wae,"writeSetting")});import xae fr...
L482: tell application "Terminal"
480where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var vae,qC=ne(()=>{Ga();Wc();vae=300;i(_He,"slotOf");i(zC,"recordAccess");i(GC,"accessRollup")});import yae from"...
L481: on conflict (name) do update set value = excluded.value, setTs = excluded.setTs`,[e,String(t),Dr()])}var Cae=ne(()=>{Ga();i(Tae,"readSetting");i(wae,"writeSetting")});import xae fr...
L482: tell application "Terminal"
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
server/WebServer.mjsView on unpkg · L480 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
server/WebServer.mjs:
`),"blockTransform")})}function c7(e,t){if(!t)return e;let r=typeof t[0]=="string"?t[0]:"[",n=typeof t[1]=="string"?t[1]:"]";return r+e+n}function gY(e,t,r,n,a){let o=typeof t=="fu...
`);n.next.cells.push({colspan:t,rowspan:r,text:a})}closeTableRow(){let t=this._popStackItem();t.next.rows.push(t.cells)}closeTable({tableToString:t,leadingLineBreaks:r=2,trailingLi...
`+Z.stack}}i(qb,"getStackByComponentStackNode");var vm=n.ReactCurrentDispatcher,hc=n.ReactDebugCurrentFrame,b1=0,Ou=1,Hb=2,GT=3,Vb=4,pp=0,qT=1,fp=2,ym=12800;function HT(y){return c...
`));if(!x)return null;Se=xe(x,!0)}return Se.shift()},"FS_stdin_getCha
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
server/WebServer.mjsView on unpkg 480where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var vae,qC=ne(()=>{Ga();Wc();vae=300;i(_He,"slotOf");i(zC,"recordAccess");i(GC,"accessRollup")});import yae from"...
L481: on conflict (name) do update set value = excluded.value, setTs = excluded.setTs`,[e,String(t),Dr()])}var Cae=ne(()=>{Ga();i(Tae,"readSetting");i(wae,"writeSetting")});import xae fr...
L482: tell application "Terminal"
...
L486: end tell
L487: end tell`.replace(/'/g,"'\\''")}'`;Kv(n)}else if(Zk==="win32")Kv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");Kv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f...
L488: `);o=u.pop();for(let d of u)yield d}o.length>0&&(yield o)}async function vie(){if(vn){let e=await import("node:fs/promises");return i(async function(r){return{mtime:(await
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
server/WebServer.mjsView on unpkg · L480 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var F5e=Object.create;var o6=Object.defineProperty;var B5e=Object.getOwnPropertyDescriptor;var U5e=Object.getOwnPropertyNames;var $5e=Object.getPrototypeOf,z5e=Object.prototype.has...
L3: `)}function dn(...e){let t=s6(2,"info");process.stderr.write(`
L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function Ln(...e){let t=s6(2,"warn");process.stderr.write(`
...
L8: `+mj(t,a.offset,a.len))}return n.value}function mj(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L9: ${"".padEnd(t)}${"^".repeat(r)}`}function Sj(e){return jxe(PD,e)}function Sl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return b6(e.na...
L10: `.repea
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
server/WebServer.mjsView on unpkg · L1 1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var F5e=Object.create;var o6=Object.defineProperty;var B5e=Object.getOwnPropertyDescriptor;var U5e=Object.getOwnPropertyNames;var $5e=Object.getPrototypeOf,z5e=Object.prototype.has...
L3: `)}function dn(...e){let t=s6(2,"info");process.stderr.write(`
L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function Ln(...e){let t=s6(2,"warn");process.stderr.write(`
...
L8: `+mj(t,a.offset,a.len))}return n.value}function mj(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L9: ${"".padEnd(t)}${"^".repeat(r)}`}function Sj(e){return jxe(PD,e)}function Sl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return b6(e.na...
L10: `.repea
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
server/WebServer.mjsView on unpkg · L1 1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution.
L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L2: var F5e=Object.create;var o6=Object.defineProperty;var B5e=Object.getOwnPropertyDescriptor;var U5e=Object.getOwnPropertyNames;var $5e=Object.getPrototypeOf,z5e=Object.prototype.has...
L3: `)}function dn(...e){let t=s6(2,"info");process.stderr.write(`
L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function Ln(...e){let t=s6(2,"warn");process.stderr.write(`
...
L8: `+mj(t,a.offset,a.len))}return n.value}function mj(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")}
L9: ${"".padEnd(t)}${"^".repeat(r)}`}function Sj(e){retu
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
server/WebServer.mjsView on unpkg · L1 480Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs
L480: where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var vae,qC=ne(()=>{Ga();Wc();vae=300;i(_He,"slotOf");i(zC,"recordAccess");i(GC,"accessRollup")});import yae from"...
L481: on conflict (name) do update set value = excluded.value, setTs = excluded.setTs`,[e,String(t),Dr()])}var Cae=ne(()=>{Ga();i(Tae,"readSetting");i(wae,"writeSetting")});import xae fr...
L482: tell application "Terminal"
...
L486: end tell
L487: end tell`.replace(/'/g,"'\\''")}'`;Kv(n)}else if(Zk==="win32")Kv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");Kv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f...
L488: `);o=u.pop();for(let d of u)yield d}o.length>0&&(yield o)}async function vie(){i
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
server/WebServer.mjsView on unpkg · L480 •matchType = normalized_sha256
matchedPackage = @knockdata/objectexplorer@0.5.9
matchedPath = server/WebServer.mjs
matchedIdentity = npm:[redacted]:0.5.9
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
server/WebServer.mjsView on unpkg