@maincode-ai/matilda-code@0.18.7: Suspicious npm security report

Loading npm security reports…

@maincode-ai/matilda-code@0.18.7: Suspicious npm security report | LPM Firewall

Source & flagged code

18 flagged

chunks/tree-sitter-bash-5CI7UGKF.jsView file

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-5CI7UGKF.js

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

chunks/computer-use-TBIPMY4B.jsView file

Lines 69-109javascript

69- cursor_opacity: 0.0\u20131.0 (default=0.85)

71Motion curve (Bezier path shape):

72- start_handle: departure control-point fraction [0,1]. Default 0.3

73- end_handle: arrival control-point fraction [0,1]. Default 0.3

74- arc_size: perpendicular deflection as fraction of path length [0,1]. Default 0.25

75- arc_flow: asymmetry [-1,1]; positive bulges toward destination. Default 0.0

76- spring: settle damping [0.3,1.0]; 1.0=no overshoot. Default 0.72

77- glide_duration_ms: fixed flight duration per move [50,5000]; omit for speed-based (the default)

78- dwell_after_click_ms: pause after click ripple [0,5000]. Default 80

79- idle_hide_ms: auto-hide delay [0,60000]; 0=never. Default 20000`,parameterSchema:{additionalProperties:!1,properties:{arc_flow:{description:"Asymmetry bias in [-1, 1]. Default 0.0.",type:"number"},arc_size:{description:"Arc deflection as fraction of path length [0, 1]. Default 0.25.",type:"number"},cursor_color:{description:"Hex color (e.g. '#00FFFF') or CSS color name.",type:"string"},cursor_icon:{description:"Built-in icon name or file path to PNG/SVG.",type:"string"},cursor_id:{description:"Cursor instance name. Default: 'default'.",type:"string"},cursor_label:{description:"Short label ne ...

81- gradient_colors: array of CSS hex strings (e.g. ["#FF0000","#0000FF"]) used as the arrow fill gradient from tip to tail. Empty array reverts to the default palette colours.

82- bloom_color: hex string for the radial halo/bloom behind the cursor (e.g. "#00FFFF"). Empty string reverts to the default.

83- image_path: path to a PNG, JPEG, SVG, or ICO file to use as the cursor icon instead of the default gradient arrow. Empty string reverts to the procedural arrow.

84All parameters are optional; omit any you do not want to change.`,parameterSchema:{additionalProperties:!1,properties:{bloom_color:{description:"Hex bloom/halo colour (e.g. '#00FFFF'). '' = revert to default.",type:"string"},cursor_id:{description:"Cursor instance. Default: 'default'.",type:"string"},gradient_colors:{

86- **AXPopUpButton / select dropdown**: finds the child option whose title or value matches \`value\` (case-insensitive) and AXPresses it directly \u2014 the native macOS popup menu is never opened, so focus is never stolen. Use this for HTML <select> elements in Safari or any native NSPopUpButton.

88- **All other elements**: writes AXValue directly (sliders, steppers, date pickers, native text fields that expose settable AXValue).

90For free-form text entry into web inputs, prefer \`type_text_chars\` which synthesises key events \u2014 AXValue writes are ignored by WebKit.`,parameterSchema:{additionalProperties:!1,properties:{element_index:{type:"integer"},pid:{type:"integer"},session:{description:"Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less."

91`)){let r=o.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);r&&t.set(r[2].trim(),r[1].toLowerCase())}return t}async function Ee(e,t=process.platform,o=process.arch,r=l){let i=u(e,t,o,r);try{if((await ke(i)).isFile())return i}catch{}}async function te(e,t,o){let r;for(let i of e)try{let n=new AbortController,s=setTimeout(()=>{n.abort(new Error(`headers timeout after 30s for ${i}`))},3e4);try{let a=await t(i,{redirect:"follow",signal:n.signal});if(a.ok&&a.body)return{url:i,res:a};await a.body?.cancel(),r=new Error(`HTTP ${a.status} for ${i}`)}finally{clearTimeout(s)}}catch(n){r=n,o?.("Source unreach ...

High

Child Process

Package source references child process execution.

chunks/computer-use-TBIPMY4B.jsView on unpkg · L89

92[Computer Use] First-time setup

93 Driver: ${t}

94 This downloads a ~20MB signed + notarized binary into ~/.matilda/computer-use/.

95 Computer Use can click, type, and read your desktop apps in the background.

96 On macOS you'll be guided through Accessibility and Screen Recording permissions next.

97Set MATILDA_COMPUTER_USE_AUTO_APPROVE=1 to skip this prompt.

98`),process.env.MATILDA_COMPUTER_USE_AUTO_APPROVE==="1"),install:t=>ie({home:e,onProgress:t}),startStatusDaemon:Ke,probePermissions:He,openPermissionPane:Ve}}async function ne(e,t,o){let r={...

100Args: ${s}

101

102This will act on your desktop via the Computer Use binary.`:`Tool: computer_use__${this.upstreamName}

103

104Args: ${s}

105

106${Ze}`;return{type:"info",title:`Allow Computer Use (${this.upstreamName})`,prompt:a,permissionRules:r,onConfirm:n}}async execute(o,r){let i=f.shared();i.setMaxImageDimension(Y(this.config?.getComputerUseMaxImageDimension()));let n=!!this.config;await ne(i,{signal:o,updateOutput:r,autoApproveInstall:n});let s;try{s=await i.callTool(this.upstreamName,this.params)}catch(c){let m=c instanceof Error?c.message:String(c);return{llmContent:`Computer Use tool '${this.upstreamName}' failed: ${m}`,returnDisplay:`Error: ${m}`,error:{message:m}}}let a=rt(s.content,this.upstreamName,s.structuredContent),p= ...

107`)}function ot(e){return e.map(t=>t.type==="text"?t.text??"":"").filter(Boolean).join(`

108`)}function it(e){if(!e||typeof e!="object")return;let t={};for(let[o,r]of Object.entries(e))o!=="tree_markdown"&&(t[o]

109/**

Long lines were clipped for display.

chunks/lowlight-XACRL7SV.jsView file

4https://github.com/highlightjs/highlight.js/issues/2277`),P=g,h=A),I===void 0&&(I=!0);let U={code:h,language:P};V("before:highlight",U);let F=U.result?U.result:m(U.language,U.code,... L5: `,1;if(he>1e5&&he>v.index*3)throw new Error("potential infinite loop, way more iterations than matches");return H+=x,x.length}let ee=L(g);if(!ee)throw pe(l.replace("{}",g)),new Err... L6: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}r();function Ua(e){let t="[a-z][a-zA-Z0-9_]*",n={className:"string",begin:"\\$.{1}"},a={className:"symbol",begin:"#"+e.UNDERSCORE_IDENT_RE}...

High

Shell

Package source references shell execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L4

chunks/serve-2QNRXUS5.jsView file

6at `+r[i].toString();return s}return e&&(s+=" at "+eo(e)),s}function Ov(t,e,r){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L7: \x1B[36mat `+r[s].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+eo(e)+"\x1B[39m"),n}function eo(t){return Iv(xv,t[0])+":"+t[1]+":"+t[2]}function os(){var t=Error.stackTr... L8: return function (`+r+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/serve-2QNRXUS5.jsView on unpkg · L6

chunks/chunk-WBVIRD3S.jsView file

Lines 1-23javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{sh as T}from"./chunk-RZLFMGMX.js";import{L as b}from"./chunk-QWBNNEV2.js";import{b as o}from"./chunk-GZPNIYVZ.js";import

chunks/workflow-PQ4HORSJ.jsView file

Lines 1-24javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{Cf as q,Jf as Q,Kf as W,Mf as Z,Nf as ee,Uf as te,pf as V}from"./chunk-RZLFMGMX.js";import"./chunk-TZIDSCTF.js";

chunks/dist-N66KF4KX.jsView file

Lines 1-22javascript

1// Force strict mode and setup for ESM

2"use strict";

3import{a as M,b as A,c as P,f as _,h as N,i as E,j as W,k as D,l as B,m as L}

chunks/chunk-DY6PIAAY.jsView file

7\v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L8: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\xA5]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uF... L9: for call at

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L7

39`,(0,kh.getIncompatibilityDetails)(a,e),`To resolve the conflict: L40: `,(0,kh.getConflictResolutionRecipe)(a,e))}return o}};Bh.MetricStorageRegistry=gb});var Y5=h(Fh=>{"use strict";l();Object.defineProperty(Fh,"__esModule",{value:!0});Fh.MultiMetricS... L41: `}var KEe="# no registered metrics",bO=class{_prefix;_appendTimestamp;_additionalAttributes;_withResourceConstantLabels;constructor(e,t=!1,o){e&&(this._prefix=e+"_"),this._appendTi... ... L49: `);for(let s of o){if(!s)continue;let a=s.indexOf(":");if(a===-1)continue;let i=s.substring(0,a).toLowerCase(),n=s.substring(a+1).trim(),c=t.get(i);c&&Array.isArray(c)?c.push(n):c?... L50: `:Array.isArray(e.headers)&&e.headers.push(M,z)}this._recordFromReq.set(e,{span:O,attributes:u,startTime:a})}onRequestHeaders({request:e,socket:t}){let o

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

chunks/chunk-DY6PIAAY.jsView on unpkg · L39

2Cross-file remote execution chain: chunks/chunk-DY6PIAAY.js spawns chunks/chunk-X6DODPXG.js; helper contains network access plus dynamic code execution. L2: "use strict"; L3: import{a as rG,b as nG,c as $_,d as iG,e as oG,f as sG,g as aG,h as cG,i as uG}from"./chunk-WVY2P6WH.js";import{b as lG}from"./chunk-UIRBHC5X.js";import{w as z_}from"./chunk-UY2R3Z... L4: \v\f\r\x1B !"#$\u066A&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xB0\xB7\u2219\u221A\u2592\u2500\u2502\u253C\u2... ... L7: \v\f\r\x1B !"#\xA5%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}\u203E\x7F\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\u... L8: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=

chunks/chunk-4J6DC24J.jsView file

2"use strict"; L3: import{a as Ka}from"./chunk-LJR4RZZ2.js";import{b as D}from"./chunk-GZPNIYVZ.js";import{a as Q,d as B,f as Ja}from"./chunk-OWGSC52X.js";var Ya=B((OS,Wa)=>{D();function xe(t,e){type... L4: `)||i,code:s,status:o},e.data.error)}return Object.assign({message:i,code:s,status:o},e.data.error)}}return{message:i,code:e.status,status:e.statusText}}};ke.GaxiosError=No;functio... L5: Content-Type: ${s}\r ... L14: `+A+"}":"{"+T.join(",")+"}",i=A,m}}typeof vl.stringify!="function"&&(vl.stringify=function(d,f,p){var h;if(i="",o="",typeof p=="number")for(h=0;h<p;h+=1)o+=" ";else typeof p=="stri... L15: `,r:"\r",t:" "},s,l=function(A){throw{name:"SyntaxError",message:A,at:n,text:s}},u=function(A){return A&&A!==i&&l("Expected '"+A+"' instead of '"+i+"'"),i=s.charAt(n),n+=1,i},c=fun...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

chunks/chunk-4J6DC24J.jsView on unpkg · L2

chunks/chunk-HCPW2R5P.jsView file

17${d}`),i?n.reset(d):d}function Qd(t,e,r,i={}){if(!Zo){Zo=!0;let l="Passing lineNumber and colNumber is deprecated to @babel/code-frame. Please use `codeFrameColumns`.";if(process.e... L18: `);let e=0;for(;t[e]&&t[e].trim().match(/^(#|$)/);)e++;let r=t.length,i=e+1;for(;i<r&&t[i].trim();)i++;return t.slice(e,i).join(" ").trim()}});var lu=R((sy,of)=>{of.exports={topLev... L19:  ... L34: Raw tool/system outputs may contain fixed-format English. Preserve them verbatim, and if needed, add a short **${t}** explanation below. L35: `}function gl(t){let e=new RegExp(String.raw``,"i"),r=t.match(e);if(r?.[1]?.trim())return r[1].trim();let i=t.match(/^#.*?CRITICAL:\s*(.*?)\s+Output Langu... L36: `)} L37: Please fix the configuration file and try again.

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

chunks/chunk-HCPW2R5P.jsView on unpkg · L17

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

chunks/chunk-RZLFMGMX.jsView file

•path = chunks/chunk-RZLFMGMX.js kind = oversized_source_file sizeBytes = 2250370 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-RZLFMGMX.jsView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 2686427 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

Source & flagged code

18 flagged · loading source

chunks/tree-sitter-bash-5CI7UGKF.jsView file

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

3patternName = aws_access_key severity = critical line = 3 matchedText = import{h...lt};

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-5CI7UGKF.js

chunks/tree-sitter-bash-5CI7UGKF.jsView on unpkg · L3

chunks/computer-use-TBIPMY4B.jsView file

89L90: For free-form text entry into web inputs, prefer \`type_text_chars\` which synthesises key events \u2014 AXValue writes are ignored by WebKit.`,parameterSchema:{additionalPropertie... L91: `)){let r=o.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);r&&t.set(r[2].trim(),r[1].toLowerCase())}return t}async function Ee(e,t=process.platform,o=process.arch,r=l){let i=u(e,t,o,r...

High

Child Process

Package source references child process execution.

chunks/computer-use-TBIPMY4B.jsView on unpkg · L89

chunks/lowlight-XACRL7SV.jsView file

High

Shell

Package source references shell execution.

chunks/lowlight-XACRL7SV.jsView on unpkg · L4

chunks/serve-2QNRXUS5.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunks/serve-2QNRXUS5.jsView on unpkg · L6

chunks/chunk-WBVIRD3S.jsView file

6`)?e:`${e} L7: `)},G=()=>{console.clear()};o();import*as c from"node:fs";import*as f from"node:path";import{pathToFileURL as E}from"node:url";o();var l=[{code:"en",id:"en-US",fullName:"English",n... L8: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-WBVIRD3S.jsView on unpkg · L6

chunks/workflow-PQ4HORSJ.jsView file

4`;)o++;continue}if(l==="/"&&c==="*"){for(o+=2;o<e.length&&!(e[o]==="*"&&e[o+1]==="/");)o++;o+=2;continue}if(l==="/"&&me(e,o)){o++;let u=!1;for(;o<e.length&&(u||e[o]!=="/")&&e[o]!==... L5: `;)e[o]==="\\"?o+=2:e[o]==="["?(u=!0,o++):(e[o]==="]"&&(u=!1),o++);for(o++;o<e.length&&/[gimsuy]/.test(e[o]);)o++;continue}if(l==='"'||l==="'"||l==="`"){let u=l;for(o++;o<e.length&... L6: const __b = globalThis.__workflowBridge; ... L42: // cannot reach host process. L43: globalThis.args = __b.argsJson === null ? undefined : JSON.parse(__b.argsJson); L44:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

chunks/workflow-PQ4HORSJ.jsView on unpkg · L4

chunks/dist-N66KF4KX.jsView file

2"use strict"; L3: import{a as M,b as A,c as P,f as _,h as N,i as E,j as W,k as D,l as B,m as L}from"./chunk-GC2F575A.js";import{f as C}from"./chunk-3HUM74NZ.js";import"./chunk-JSFA3NEP.js";import"./... L4: `);!i.aborted;)try{let n=await N(t,o,s,a,i);if(n.errcode===-14){process.stderr.write(`[weixin] Session expired (errcode -14). Pausing 30s... ... L8: `)}async function ce(e,t){if(e.message_type!==h.USER)return;let o=e.from_user_id;if(!o)return;e.context_token&&F.set(o,e.context_token);let r="",i,s,c;if(e.item_list)for(let a of e... L9: `:"")+a.text_item.text),a.ref_msg){let n=a.ref_msg.message_item;n?.text_item?.text?c=n.text_item.text:a.ref_msg.title&&(c=a.ref_msg.title)}if(a.type===g.IMAGE&&a.image_item){let n=... L10:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/dist-N66KF4KX.jsView on unpkg · L2