@maincode-ai/matilda-code@0.18.6: Suspicious npm security report

Loading npm security reports…

@maincode-ai/matilda-code@0.18.6: Suspicious npm security report | LPM Firewall

Source & flagged code

18 flagged

chunks/tree-sitter-bash-5CI7UGKF.jsView file

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-5CI7UGKF.js

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

chunks/lowlight-XACRL7SV.jsView file

2"use strict"; L3: import{b as r}from"./chunk-GZPNIYVZ.js";import{d as zi,f as Wi}from"./chunk-OWGSC52X.js";var Li=zi((Gb,Mi)=>{r();function bi(e){return e instanceof Map?e.clear=e.delete=e.set=funct... L4: https://github.com/highlightjs/highlight.js/issues/2277`),P=g,h=A),I===void 0&&(I=!0);let U={code:h,language:P};V("before:highlight",U);let F=U.result?U.result:m(U.language,U.code,...

High

Child Process

Package source references child process execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L2

4https://github.com/highlightjs/highlight.js/issues/2277`),P=g,h=A),I===void 0&&(I=!0);let U={code:h,language:P};V("before:highlight",U);let F=U.result?U.result:m(U.language,U.code,... L5: `,1;if(he>1e5&&he>v.index*3)throw new Error("potential infinite loop, way more iterations than matches");return H+=x,x.length}let ee=L(g);if(!ee)throw pe(l.replace("{}",g)),new Err... L6: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}r();function Ua(e){let t="[a-z][a-zA-Z0-9_]*",n={className:"string",begin:"\\$.{1}"},a={className:"symbol",begin:"#"+e.UNDERSCORE_IDENT_RE}...

High

Shell

Package source references shell execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L4

chunks/serve-2YD4FDDR.jsView file

6at `+r[i].toString();return s}return e&&(s+=" at "+eo(e)),s}function Ov(t,e,r){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L7: \x1B[36mat `+r[s].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+eo(e)+"\x1B[39m"),n}function eo(t){return Iv(xv,t[0])+":"+t[1]+":"+t[2]}function os(){var t=Error.stackTr... L8: return function (`+r+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/serve-2YD4FDDR.jsView on unpkg · L6

chunks/chunk-NLDXLQ7S.jsView file

Lines 1-23javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{sh as T}from"./chunk-KRLQXLKD.js";import{L as b}from"./chunk-QWBNNEV2.js";import{b as o}from"./chunk-GZPNIYVZ.js";import

chunks/workflow-5652UIA4.jsView file

Lines 1-24javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{Cf as q,Jf as Q,Kf as W,Mf as Z,Nf as ee,Uf as te,pf as V}from"./chunk-KRLQXLKD.js";import"./chunk-TZIDSCTF.js";

chunks/dist-N66KF4KX.jsView file

Lines 1-22javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{a as M,b as A,c as P,f as _,h as N,i as E,j as W,k as D,l as B,m as L}

chunks/chunk-DY6PIAAY.jsView file

7\v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L8: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uF... L9: for call at

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L7

39`,(0,kh.getIncompatibilityDetails)(a,e),`To resolve the conflict: L40: `,(0,kh.getConflictResolutionRecipe)(a,e))}return o}};Bh.MetricStorageRegistry=gb});var Y5=h(Fh=>{"use strict";l();Object.defineProperty(Fh,"__esModule",{value:!0});Fh.MultiMetricS... L41: `}var KEe="# no registered metrics",bO=class{_prefix;_appendTimestamp;_additionalAttributes;_withResourceConstantLabels;constructor(e,t=!1,o){e&&(this._prefix=e+"_"),this._appendTi... ... L49: `);for(let s of o){if(!s)continue;let a=s.indexOf(":");if(a===-1)continue;let i=s.substring(0,a).toLowerCase(),n=s.substring(a+1).trim(),c=t.get(i);c&&Array.isArray(c)?c.push(n):c?... L50: `:Array.isArray(e.headers)&&e.headers.push(M,z)}this._recordFromReq.set(e,{span:O,attributes:u,startTime:a})}onRequestHeaders({request:e,socket:t}){let o

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L39

2Cross-file remote execution chain: chunks/chunk-DY6PIAAY.js spawns chunks/chunk-X6DODPXG.js; helper contains network access plus dynamic code execution. L2: "use strict"; L3: import{a as rG,b as nG,c as $_,d as iG,e as oG,f as sG,g as aG,h as cG,i as uG}from"./chunk-WVY2P6WH.js";import{b as lG}from"./chunk-UIRBHC5X.js";import{w as z_}from"./chunk-UY2R3Z... L4: \v\f\r\x1B !"#$\u066A&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xB0\xB7\u2219\u221A\u2592\u2500\u2502\u253C\u2... ... L7: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L8: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=

chunks/chunk-4J6DC24J.jsView file

2"use strict"; L3: import{a as Ka}from"./chunk-LJR4RZZ2.js";import{b as D}from"./chunk-GZPNIYVZ.js";import{a as Q,d as B,f as Ja}from"./chunk-OWGSC52X.js";var Ya=B((OS,Wa)=>{D();function xe(t,e){type... L4: `)||i,code:s,status:o},e.data.error)}return Object.assign({message:i,code:s,status:o},e.data.error)}}return{message:i,code:e.status,status:e.statusText}}};ke.GaxiosError=No;functio... L5: Content-Type: ${s}\r ... L14: `+A+"}":"{"+T.join(",")+"}",i=A,m}}typeof vl.stringify!="function"&&(vl.stringify=function(d,f,p){var h;if(i="",o="",typeof p=="number")for(h=0;h<p;h+=1)o+=" ";else typeof p=="stri... L15: `,r:"\r",t:" "},s,l=function(A){throw{name:"SyntaxError",message:A,at:n,text:s}},u=function(A){return A&&A!==i&&l("Expected '"+A+"' instead of '"+i+"'"),i=s.charAt(n),n+=1,i},c=fun...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

chunks/chunk-4J6DC24J.jsView on unpkg · L2

chunks/chunk-L2FKQQ7C.jsView file

17${d}`),i?n.reset(d):d}function Qd(t,e,r,i={}){if(!Zo){Zo=!0;let l="Passing lineNumber and colNumber is deprecated to @babel/code-frame. Please use `codeFrameColumns`.";if(process.e... L18: `);let e=0;for(;t[e]&&t[e].trim().match(/^(#|$)/);)e++;let r=t.length,i=e+1;for(;i<r&&t[i].trim();)i++;return t.slice(e,i).join(" ").trim()}});var lu=R((sy,of)=>{of.exports={topLev... L19:  ... L34: Raw tool/system outputs may contain fixed-format English. Preserve them verbatim, and if needed, add a short **${t}** explanation below. L35: `}function gl(t){let e=new RegExp(String.raw``,"i"),r=t.match(e);if(r?.[1]?.trim())return r[1].trim();let i=t.match(/^#.*?CRITICAL:\s*(.*?)\s+Output Langu... L36: `)} L37: Please fix the configuration file and try again.

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-L2FKQQ7C.jsView on unpkg · L17

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

chunks/chunk-KRLQXLKD.jsView file

•path = chunks/chunk-KRLQXLKD.js kind = oversized_source_file sizeBytes = 2250370 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-KRLQXLKD.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 2686427 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

Source & flagged code

18 flagged · loading source

chunks/tree-sitter-bash-5CI7UGKF.jsView file

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-5CI7UGKF.js

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

chunks/lowlight-XACRL7SV.jsView file

High

Child Process

Package source references child process execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L2

High

Shell

Package source references shell execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L4

chunks/serve-2YD4FDDR.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/serve-2YD4FDDR.jsView on unpkg · L6

chunks/chunk-NLDXLQ7S.jsView file

6`)?e:`${e} L7: `)},G=()=>{console.clear()};o();import*as c from"node:fs";import*as f from"node:path";import{pathToFileURL as E}from"node:url";o();var l=[{code:"en",id:"en-US",fullName:"English",n... L8: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-NLDXLQ7S.jsView on unpkg · L6

chunks/workflow-5652UIA4.jsView file

4`;)o++;continue}if(l==="/"&&c==="*"){for(o+=2;o<e.length&&!(e[o]==="*"&&e[o+1]==="/");)o++;o+=2;continue}if(l==="/"&&me(e,o)){o++;let u=!1;for(;o<e.length&&(u||e[o]!=="/")&&e[o]!==... L5: `;)e[o]==="\\"?o+=2:e[o]==="["?(u=!0,o++):(e[o]==="]"&&(u=!1),o++);for(o++;o<e.length&&/[gimsuy]/.test(e[o]);)o++;continue}if(l==='"'||l==="'"||l==="`"){let u=l;for(o++;o<e.length&... L6: const __b = globalThis.__workflowBridge; ... L42: // cannot reach host process. L43: globalThis.args = __b.argsJson === null ? undefined : JSON.parse(__b.argsJson); L44:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

chunks/workflow-5652UIA4.jsView on unpkg · L4

chunks/dist-N66KF4KX.jsView file

2"use strict"; L3: import{a as M,b as A,c as P,f as _,h as N,i as E,j as W,k as D,l as B,m as L}from"./chunk-GC2F575A.js";import{f as C}from"./chunk-3HUM74NZ.js";import"./chunk-JSFA3NEP.js";import"./... L4: `);!i.aborted;)try{let n=await N(t,o,s,a,i);if(n.errcode===-14){process.stderr.write(`[weixin] Session expired (errcode -14). Pausing 30s... ... L8: `)}async function ce(e,t){if(e.message_type!==h.USER)return;let o=e.from_user_id;if(!o)return;e.context_token&&F.set(o,e.context_token);let r="",i,s,c;if(e.item_list)for(let a of e... L9: `:"")+a.text_item.text),a.ref_msg){let n=a.ref_msg.message_item;n?.text_item?.text?c=n.text_item.text:a.ref_msg.title&&(c=a.ref_msg.title)}if(a.type===g.IMAGE&&a.image_item){let n=... L10:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/dist-N66KF4KX.jsView on unpkg · L2

chunks/chunk-DY6PIAAY.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L39

chunks/chunk-4J6DC24J.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

chunks/chunk-4J6DC24J.jsView on unpkg · L2

chunks/chunk-L2FKQQ7C.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-L2FKQQ7C.jsView on unpkg · L17

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

chunks/chunk-KRLQXLKD.jsView file

•path = chunks/chunk-KRLQXLKD.js kind = oversized_source_file sizeBytes = 2250370 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-KRLQXLKD.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 2686427 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

Source & flagged code

18 flagged

chunks/tree-sitter-bash-5CI7UGKF.jsView file

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-5CI7UGKF.js

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

chunks/lowlight-XACRL7SV.jsView file

High

Child Process

Package source references child process execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L2

High

Shell

Package source references shell execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L4

chunks/serve-2YD4FDDR.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/serve-2YD4FDDR.jsView on unpkg · L6

chunks/chunk-NLDXLQ7S.jsView file

Lines 1-23javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{sh as T}from"./chunk-KRLQXLKD.js";import{L as b}from"./chunk-QWBNNEV2.js";import{b as o}from"./chunk-GZPNIYVZ.js";import

chunks/workflow-5652UIA4.jsView file

Lines 1-24javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{Cf as q,Jf as Q,Kf as W,Mf as Z,Nf as ee,Uf as te,pf as V}from"./chunk-KRLQXLKD.js";import"./chunk-TZIDSCTF.js";

chunks/dist-N66KF4KX.jsView file

Lines 1-22javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{a as M,b as A,c as P,f as _,h as N,i as E,j as W,k as D,l as B,m as L}

chunks/chunk-DY6PIAAY.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L39

chunks/chunk-4J6DC24J.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

chunks/chunk-4J6DC24J.jsView on unpkg · L2

chunks/chunk-L2FKQQ7C.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-L2FKQQ7C.jsView on unpkg · L17

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

chunks/chunk-KRLQXLKD.jsView file

•path = chunks/chunk-KRLQXLKD.js kind = oversized_source_file sizeBytes = 2250370 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-KRLQXLKD.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 2686427 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

@maincode-ai/matilda-code@0.18.6

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code