registry / @mdevs/mai-cli / 1.0.19

@mdevs/mai-cli@1.0.19

The mAI agent, directly in your terminal!

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically invokes a separate Chrome MCP bridge registration flow. It also fetches and installs a remote executable into the package directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs the postinstall lifecycle hook.

Impact

An install can alter an AI-agent/browser integration without an explicit user command and place a remotely fetched executable in the package.

Mechanism

Automatic Chrome MCP bridge registration and remote binary download.

Policy narrative

On installation, the package launches a script that loads a separate Claude Chrome bridge and runs its full setup, including registration for Chrome. This occurs automatically unless the installer already knows to set a skip environment variable. The lifecycle hook also downloads a platform-specific ripgrep executable from remote release URLs and writes it under the package vendor directory without verifying a checksum.

Rationale

The automatic postinstall registration changes an external AI-agent/browser integration without an explicit user action. This is a concrete unconsented lifecycle control-surface mutation, not merely a dormant CLI capability.

Evidence

package.jsonscripts/run-parallel.mjsscripts/setup-chrome-mcp.mjsscripts/postinstall.cjsdist/vendor/ripgrep

Network endpoints2

github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically starts the Chrome MCP setup script.
The setup script resolves a separate Claude Chrome bridge and runs its register command without user input.
The only suppression is an environment-variable opt-out, so normal installation performs the registration.
The same install hook downloads and installs an executable ripgrep binary from remote release URLs without an integrity check.

Evidence against

The remote download is explicitly labelled as ripgrep and is installed only under the package vendor directory.
The inspected lifecycle scripts show no credential-file collection or outbound transmission of local data.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Manifest

NoLicense

scanned 630 file(s), 10.4 MB of source, external domains: 1.1.1.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, aka.ms, anthropic.com, api-staging.anthropic.com, api.anthropic.com, api.deepseek.com, app.corridor.dev, aws.amazon.com, clau.de, cli.github.com, console.anthropic.com, docs.anthropic.com, docs.aws.amazon.com, docs.expo.dev, evil.com, example.com, fonts.googleapis.com, generativelanguage.googleapis.com, ghproxy.net, git-scm.com, github.com, grpc.io, ilinkai.weixin.qq.com, json-schema.org, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.windows-ppe.net, mai-devs.vercel.app, mai.val.run, mcp-proxy-staging.anthropic.com, mcp-proxy.anthropic.com, mcp.exa.ai, mcp.sentry.dev, metcoder.dev, novac2c.cdn.weixin.qq.com, opencollective.com, platform.claude.com, platform.staging.ant.dev, portal.sso, portal.sso-fips, raw.githubusercontent.com, react-native.canny.io, react.dev, s.io

Oversized source lightweight scan

dist/chunks/loadAgentsDir-DbE28Kw5.js4.13 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsevil.com

Source & flagged code

19 flagged

package.jsonView file

Lines 45-85json

45 "build:vite": "vite build && bun run scripts/post-build.ts",

46 "build:vite:only": "vite build",

47 "build:bun": "bun run build.ts",

48 "dev": "bun run scripts/dev.ts",

49 "dev:inspect": "bun run scripts/dev-debug.ts",

50 "prepublishOnly": "bun run build:vite",

51 "lint": "biome lint .",

52 "lint:fix": "biome lint --fix .",

53 "format": "biome format --write .",

54 "check": "biome check .",

55 "check:fix": "biome check --fix .",

56 "prepare": "husky",

57 "test": "bun test",

58 "test:production": "bun run scripts/production-test.ts",

59 "test:production:offline": "bun run scripts/production-test.ts --offline",

60 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

61 "test:production:bun": "bun run scripts/production-test.ts --bun",

62 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

63 "check:unused": "knip-bun",

64 "health": "bun run scripts/health-check.ts",

65 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L65

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L65

66 "docs:dev": "npx mintlify dev",

67 "typecheck": "tsc --noEmit",

68 "precheck": "bun run typecheck && bun run check:fix && bun test",

69 "rcs": "bun run scripts/rcs.ts",

70 "reset:api": "node --env-file=.env scripts/reset-api-usage.js",

71 "reset:mai": "node --env-file=.env scripts/reset-mai-usage.js"

72 },

73 "dependencies": {

74 "@agentclientprotocol/sdk": "^0.19.0",

75 "@claude-code-best/mcp-chrome-bridge": "^3.0.1",

76 "highlight.js": "^11.11.1",

77 "ws": "^8.20.0"

78 },

79 "devDependencies": {

80 "@alcalzone/ansi-tokenize": "^0.3.0",

81 "@ant/claude-for-chrome-mcp": "workspace:*",

82 "@ant/computer-use-input": "workspace:*",

83 "@ant/computer-use-mcp": "workspace:*",

84 "@ant/computer-use-swift": "workspace:*",

85 "@ant/model-provider": "workspace:*",

dist/chunks/protocolHandler-DPRTysDg.jsView file

Lines 1-13javascript

1import{uc as e,vc as t}from"./paths-DMlOzjeq.js";import{E as n,O as r,l as i,p as a}from"./debug-Cisktvhb.js";import{n as o,t as s}from"./which-B3H7JXgq.js";import{r as c,t as l}from"./execFileNoThrow-CbGZxBmY.js";import{n as u,t as d}from"./githubRepoPathMapping-CtrUNN5S.js";import{n as f}from"./banner-7wHgOchu.js";import{a as p,i as m,n as h}from"./registerProtocol-i80KFJgT.js";import{homedir as g}from"os";import{basename as _}from"path";import{spawn as v}from"child_process";n(),m(),h(),t(),i(),c(),s();var y=[{name:`iTerm2`,bundleId:`com.googlecode.iterm2`,app:`iTerm`},{name:`Ghostty`,bundle ...

2 if running then

High

Child Process

Package source references child process execution.

dist/chunks/protocolHandler-DPRTysDg.jsView on unpkg · L1

3 create window with default profile

4 else

5 activate

6 end if

7 tell current session of current window

8 write text ${M(A(t,n,r))}

9 end tell

10end tell`],{useCwd:!1});if(e===0)return!0;break}case`Terminal`:{let{code:e}=await l(`osascript`,[`-e`,`tell application "Terminal"

11 do script ${M(A(t,n,r))}

12 activate

13end tell`],{useCwd:!1});return e===0}case`Ghostty`:{let i=[`-na`,e.command,`--args`,`--window-save-state=never`];r&&i.push(`--working-directory=${r}`),i.push(`-e`,t,...n);let{code:a}=await l(`open`,i,{useCwd:!1});if(a===0)return!0;break}case`Alacritty`:{let i=[`-na`,e.command,`--args`];r&&i.push(`--working-directory`,r),i.push(`-e`,t,...n);let{code:a}=await l(`open`,i,{useCwd:!1});if(a===0)return!0;break}case`kitty`:{let i=[`-na`,e.command,`--args`];r&&i.push(`--directory`,r),i.push(t,...n);let{code:a}=await l(`open`,i,{useCwd:!1});if(a===0)return!0;break}case`WezTerm`:{let i=[`-na`,e.command, ...

Long lines were clipped for display.

dist/chunks/prompt-DPZFWvZz.jsView file

Lines 129-169javascript

129Prefer this over \`Bash(sleep ...)\` — it doesn't hold a shell process.

130

131Each wake-up costs an API call, but the prompt cache expires after 5 minutes of inactivity — balance accordingly.`})),Cn,wn=e((()=>{Cn=`Interact with Language Server Protocol (LSP) servers to get code intelligence features.

132

133Supported operations:

134- goToDefinition: Find where a symbol is defined

135- findReferences: Find all references to a symbol

136- hover: Get hover information (documentation, type info) for a symbol

137- documentSymbol: Get all symbols (functions, classes, variables) in a document

138- workspaceSymbol: Search for symbols across the entire workspace

139- goToImplementation: Find implementations of an interface or abstract method

140- prepareCallHierarchy: Get call hierarchy item at a position (functions/methods)

141- incomingCalls: Find all functions/methods that call the function at a position

142- outgoingCalls: Find all functions/methods called by the function at a position

143

144All operations require:

145- filePath: The file to operate on

146- line: The line number (1-based, as shown in editors)

147- character: The character offset (1-based, as shown in editors)

148

149Note: LSP servers must be configured for the file type. If no server is available, an error will be returned.`})),Tn=n({VERIFY_PLAN_EXECUTION_TOOL_NAME:()=>I}),I,En=e((()=>{I=`VerifyPlanExecution`})),L,Dn=e((()=>{L=`ExecuteExtraTool`})),On,kn=e((()=>{On=`EnterWorktree`})),An,jn=e((()=>{An=`ExitWorktree`})),Mn=e((()=>{})),R,z,Nn,B,Pn,V,H=e((()=>{R=`Workflow`,z=`.claude/workflows`,Nn=`.claude/workflow-runs`,B=[`.ts`,`.js`,`.mjs`],Pn=1e3,V=4096}));function Fn(e){return{[U]:e}}function In(e){return typeof e==`object`&&!!e&&U in e}function Ln(e){return e[U]}var U,Rn=e((()=>{U=Symbol(`workflow.hostH ...

150`)}}function Jn(e){if(typeof e!=`object`||!e||Array.isArray(e))throw new G(`meta must be an object`);let t=e;if(typeof t.name!=`string`||typeof t.description!=`string`)throw new G(`meta must include string name and description`);return t}function Yn(){let e=function(...e){if(e.length===0)throw new $n(`Date.now()/new Date()`);return new Date(...e)};return e.now=()=>{throw new $n(`Date.now()`)},e.parse=Date.parse,e.UTC=Date.UTC,e}function Xn(){return new Proxy(Math,{get(e,t,n){return t===`random`?()=>{throw new $n(`Math.random()`)}:Reflect.get(e,t,n)}})}function Zn(e){if(/^\s*import\b/m.test(e)) ...

151`+nr(t)).digest(`hex`)}function ir(e){let t=t=>h(e,t,`journal.jsonl`);return{async read(e){try{return(await _(t(e),`utf-8`)).split(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/prompt-DPZFWvZz.jsView on unpkg · L149

152`).filter(e=>e.trim().length>0).map(e=>JSON.parse(e)).sort((e,t)=>(e.seq??0)-(t.seq??0))}catch{return[]}},async append(n,r){await Je(h(e,n),{recursive:!0}),await qe(t(n),JSON.stringify(r)+`

153`,`utf-8`)},async truncate(t){await Xe(h(e,t),{recursive:!0,force:!0})}}}var ar=e((()=>{})),or,sr,cr=e((()=>{c(),or=class extends Error{constructor(){super(`workflow token budget exhausted (budget.total reached the cap)`),this.name=`BudgetExhaustedError`}},sr=class{constructor(e){l(this,`spentTokens`,0),this.total=e}spent(){return this.spentTokens}remaining(){return this.total==null?1/0:Math.max(0,this.total-this.spentTokens)}addOutputTokens(e){e>0&&(this.spentTokens+=e)}assertCanSpend(){if(this.total!=null&&this.spentTokens>=this.total)throw new or}}}));function lr(e,t){let n=dr.get(t);n||(n= ...

154`)}}},mapToolResultToToolResultBlockParam(e,t){return{tool_use_id:t,type:`tool_result`,content:[{type:`text`,text:e.output}]}}}}function Rr(e,t,n){if(t.status===`completed`){let r=t.returnValue==null?`(no return value)`:zr(t.returnValue);e.taskRegistrar.complete(n,r)}else t.status===`failed`?e.taskRegistrar.fail(n,t.error??`workflow failed`):e.taskRegistrar.kill(n)}function zr(e){if(typeof e==`string`)return e.slice(0,500);try{return JSON.stringify(e).slice(0,500)}catch{return String(e)}}function Br(e){if(typeof e!=`string`)return e;try{let t=JSON.parse(e);return typeof t==`object`&&t?t:e}catc ...

155`,`utf-8`)}async function Yr(e,t,n,r,i){let a=We().slice(0,8),o={id:a,cron:e,prompt:t,createdAt:Date.now(),...n?{recurring:!0}:{}};if(!r)return ie({...o,...i?{agentId:i}:{}}),a;let s=await J();return s.push(o),await Jr(s),a}async function Xr(e,t){if(e.length===0||t===void 0&&oe(e)===e.length)return;let n=new Set(e),r=await J(t),i=r.filter(e=>!n.has(e.id));i.length!==r.length&&await Jr(i,t)}async function Zr(e,t,n){if(e.length===0)return;let r=new Set(e),i=await J(n),a=!1;for(let e of i)r.has(e.id)&&(e.lastFiredAt=t,a=!0);a&&await Jr(i,n)}async function Qr(e){let t=await J(e);if(e!==void 0)retu ...

156

157Uses standard 5-field cron in the user's local timezone: minute hour day-of-month month day-of-week. "0 9 * * *" means 9am local — no timezone conversion needed.

158

159## One-shot tasks (recurring: false)

160

161For "remind me at X" or "at <time>, do Y" requests — fire once then auto-delete.

162Pin minute/hour/day-of-month/month to specific values:

163 "remind me at 2:30pm today to check the deploy" → cron: "30 14 <today_dom> <today_month> *", recurring: false

164 "tomorrow morning, run the smoke test" → cron: "57 8 <tomorrow_dom> <tomorrow_month> *", recurring: false

165

166## Recurring jobs (recurring: true, the default)

167

168For "every N minutes" / "every hour" / "weekdays at 9am" requests:

169 "*/5 * * * *" (every 5 min), "0 * * * *" (hourly), "0 9 * * 1-5" (weekdays at 9am local)

Long lines were clipped for display.

dist/chunks/dist-es-fjXft-jH.jsView file

Lines 1-1javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as a}from"path";import{createHash as o}from"crypto";import{readFile as s}from"fs/promises";import{readFile as c}from"node:fs/promises";var l,u,d,f=e((()=>{l={},u=()=>process&&process.geteuid?`${process.geteuid()}`:`DEFAULT`,d=()=>{let{HOME:e,USERPROFILE:t,HOMEPATH:n,HOMEDRIVE:i=`C:${a}`}=process.env;if(e)return e;if(t)return t;if(n)return`${i}${n}`;let o=u();return l[o]||(l[o]=r()),l[o]}})),p,m,h=e((()=>{p=`AWS_PROFILE`,m=e=>e.profile||process.env.AWS_PROFI ...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-es-fjXft-jH.jsView on unpkg · L1

Long lines were clipped for display.

dist/chunks/sentry-BEp-gDrC.jsView file

6`).concat(`\r L7: `):``}function bw(e,t){let n=-1;for(let r=0;r<e.length;r+=2){if(e[r]!==t)continue;if(n===-1){n=r;continue}let i=e[n+1];if(t===Ew&&i){let t=qC(e[r+1],i);t&&(e[n+1]=t)}e.splice(r,2),... L8: `).some(e=>e.indexOf(`(https.js:`)!==-1||e.indexOf(`node:https:`)!==-1):!1}createSocket(e,t,n){let r={...t,secureEndpoint:this.isSecureEndpoint(t)};Promise.resolve().then(()=>this....

Critical

Protestware

Package source matches protestware-related patterns.

dist/chunks/sentry-BEp-gDrC.jsView on unpkg · L6

1import{a as e,i as t,n,r,t as i}from"./chunk-DR8-3Aex.js";import{n as a,t as o}from"./defineProperty-80gRi2ZW.js";import{a as s,c,i as l,l as u,n as d,o as f,r as p,s as m,t as h,u... L2: `);for(let e=n;e<a.length;e++){let n=a[e];n.length>1024&&(n=n.slice(0,1024));let o=Jo.test(n)?n.replace(Jo,`$1`):n;if(!o.includes(`Error: `)){for(let e of t){let t=e(o);if(t){i.pus...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/sentry-BEp-gDrC.jsView on unpkg · L1

scripts/postinstall.cjsView file

Lines 3-43javascript

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

12 */

14const {

15 existsSync,

16 mkdirSync,

17 readFileSync,

18 renameSync,

19 rmSync,

20 statSync,

21 writeFileSync,

22 chmodSync,

23} = require('fs')

24const { spawnSync } = require('child_process')

25const { setDefaultResultOrder } = require('node:dns')

26const path = require('path')

27const os = require('os')

29// Prefer IPv4 first — Bun on Windows sometimes fails GitHub over broken IPv6 paths.

30try {

31 setDefaultResultOrder('ipv4first')

32} catch {

33 /* ignore */

34}

36// --- Config ---

38const RG_VERSION = '15.0.1'

39const DEFAULT_RELEASE_BASE = `https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}`

40const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}`

41const RELEASE_BASE = (

42 process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE

43).replace(/\/$/, '')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L170: } L171: return Buffer.from(await response.arrayBuffer())

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

dist/chunks/dist-es-DuAZyxJ02.jsView file

Lines 1-5javascript

1import{n as e}from"./chunk-DR8-3Aex.js";import{r as t,t as n}from"./dist-es-C41b_0B5.js";import{E as r,I as i,N as a,T as o,h as s}from"./protocols-CAyQOlkr.js";import{h as c,t as l}from"./client-CPn1wQyc.js";import{o as u,t as d}from"./dist-es-CUZBYppo.js";import{t as f}from"./dist-es-UAs0rdXg.js";import p from"node:fs/promises";var m,h,g,_,v=e((()=>{d(),m=`169.254.170.2`,h=`169.254.170.23`,g=`[fd00:ec2::23]`,_=(e,t)=>{if(e.protocol!==`https:`&&!(e.hostname===m||e.hostname===h||e.hostname===g)){if(e.hostname.includes(`[`)){if(e.hostname===`[::1]`||e.hostname===`[0000:0000:0000:0000:0000:0000: ...

2 - loopback CIDR 127.0.0.0/8 or [::1/128]

3 - ECS container host 169.254.170.2

4 - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((e,[t,n])=>(e[t]=n,e),{}),fragment:e.hash})}async function b(e,t){let n=await r(e.body).transformToString();if(e.statusCode===200){let e=JSON.parse(n);if(typeof e.AccessKeyId!=`string`||typeof e.SecretAccessKey!=`string`||typeof e.Token!=`string`||typeof e.Expiration!=`string`)throw new u(`HTTP credential provider response not of the required format, an object matching: ...

5Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,connectionTimeout:e.timeout??1e3});return S(async()=>{let t=y(l);a?t.headers.Authorization=a:o&&(t.headers.Authorization=(await p.readFile(o)).toString());try{return b((await d.handle(t)).response).then(e=>c(e,`CREDENTIALS_HTTP`,`z`))}catch(t){throw new u(String(t),{logger:e.logger})}},e.maxRetries??3,e.timeout??1e3)}})),j=e((()=>{A()}));export{k as n,j as t};

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

Long lines were clipped for display.

dist/chunks/src-B4RZ3Bik.jsView file

19contains invisible/control Unicode U+200D (zero width joiner) `?(i+=e,a=0):(i+=e,a+=ba(e))}return i}var La,Ra=t((()=>{xa(),Mr(),La=8}));function za(){let e=new Map;for(let[t,n]of Object.entries(W)){for(let[t,r]of Object.entries(n))W[t]={open:`\u001B[${r[0]}m`,close:`\u001B[${r[1]}m`},n[t]=W[t],e.set(r

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/src-B4RZ3Bik.jsView on unpkg · L19

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-DbE28Kw5.jsView file

•path = dist/chunks/loadAgentsDir-DbE28Kw5.js kind = oversized_source_file sizeBytes = 4328739 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-DbE28Kw5.jsView on unpkg

dist/chunks/ValidationErrorsList-DEKZebgA.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/ValidationErrorsList-DEKZebgA.jsView on unpkg

dist/chunks/createSSHSession-cz2LbC-m.jsView file

•matchType = normalized_sha256 matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/createSSHSession-BBhIjkxV.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/createSSHSession-cz2LbC-m.jsView on unpkg

dist/chunks/dist-Cg1a1Exw.jsView file

•matchType = normalized_sha256 matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/dist-Cg1a1Exw.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/dist-Cg1a1Exw.jsView on unpkg

dist/chunks/executor-0LskEQWE.jsView file

•matchType = normalized_sha256 matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/executor-DX6OkCOF.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/executor-0LskEQWE.jsView on unpkg

dist/chunks/open-CDditBQ-.jsView file

•matchType = normalized_sha256 matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/open-CDditBQ-.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/open-CDditBQ-.jsView on unpkg

dist/chunks/cliLaunch-BQLM_VtG.jsView file

•matchType = normalized_sha256 matchedPackage = @twinklerg/ccb@2.8.6 matchedPath = dist/chunks/cliLaunch-DJnBNDkM.js matchedIdentity = npm:QHR3aW5rbGVyZy9jY2I:2.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cliLaunch-BQLM_VtG.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunks/protocolHandler-DPRTysDg.jsView file

High

Child Process

Package source references child process execution.

dist/chunks/protocolHandler-DPRTysDg.jsView on unpkg · L1

dist/chunks/prompt-DPZFWvZz.jsView file

149Note: LSP servers must be configured for the file type. If no server is available, an error will be returned.`})),Tn=n({VERIFY_PLAN_EXECUTION_TOOL_NAME:()=>I}),I,En=e((()=>{I=`Veri... L150: `)}}function Jn(e){if(typeof e!=`object`||!e||Array.isArray(e))throw new G(`meta must be an object`);let t=e;if(typeof t.name!=`string`||typeof t.description!=`string`)throw new G(... L151: `+nr(t)).digest(`hex`)}function ir(e){let t=t=>h(e,t,`journal.jsonl`);return{async read(e){try{return(await _(t(e),`utf-8`)).split(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/prompt-DPZFWvZz.jsView on unpkg · L149

dist/chunks/dist-es-fjXft-jH.jsView file

1import{n as e}from"./chunk-DR8-3Aex.js";import{n as t,t as n}from"./dist-es-DPM0mPK5.js";import{homedir as r}from"os";import{join as i,sep as a}from"path";import{createHash as o}fr...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-es-fjXft-jH.jsView on unpkg · L1

dist/chunks/sentry-BEp-gDrC.jsView file

Critical

Protestware

Package source matches protestware-related patterns.

dist/chunks/sentry-BEp-gDrC.jsView on unpkg · L6

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunks/sentry-BEp-gDrC.jsView on unpkg · L1

scripts/postinstall.cjsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

dist/chunks/dist-es-DuAZyxJ02.jsView file

3- ECS container host 169.254.170.2 L4: - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:t})}}}));function y(e){return new t({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,quer... L5: Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let l=new URL(t);_(l,e.logger);let d=i.create({requestTimeout:e.timeout??1e3,c...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/dist-es-DuAZyxJ02.jsView on unpkg · L3

dist/chunks/src-B4RZ3Bik.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunks/src-B4RZ3Bik.jsView on unpkg · L19

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/chunks/loadAgentsDir-DbE28Kw5.jsView file

•path = dist/chunks/loadAgentsDir-DbE28Kw5.js kind = oversized_source_file sizeBytes = 4328739 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/loadAgentsDir-DbE28Kw5.jsView on unpkg

dist/chunks/ValidationErrorsList-DEKZebgA.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/ValidationErrorsList-DEKZebgA.jsView on unpkg

dist/chunks/createSSHSession-cz2LbC-m.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/createSSHSession-cz2LbC-m.jsView on unpkg

dist/chunks/dist-Cg1a1Exw.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/dist-Cg1a1Exw.jsView on unpkg

dist/chunks/executor-0LskEQWE.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/executor-0LskEQWE.jsView on unpkg

dist/chunks/open-CDditBQ-.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/open-CDditBQ-.jsView on unpkg

dist/chunks/cliLaunch-BQLM_VtG.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunks/cliLaunch-BQLM_VtG.jsView on unpkg

Findings

2 Critical13 High7 Medium8 Low

CriticalTrojan Source Unicodedist/chunks/src-B4RZ3Bik.js

CriticalProtestwaredist/chunks/sentry-BEp-gDrC.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunks/protocolHandler-DPRTysDg.js

HighShell

HighSame File Env Network Executiondist/chunks/sentry-BEp-gDrC.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighCloud Metadata Accessdist/chunks/dist-es-DuAZyxJ02.js

HighInstall Named Payload Filescripts/postinstall.cjs

HighSemantic Analysis Limiteddist/chunks/ValidationErrorsList-DEKZebgA.js

HighKnown Malware Source Similaritydist/chunks/createSSHSession-cz2LbC-m.js

HighKnown Malware Source Similaritydist/chunks/dist-Cg1a1Exw.js

HighKnown Malware Source Similaritydist/chunks/executor-0LskEQWE.js

HighKnown Malware Source Similaritydist/chunks/open-CDditBQ-.js

HighKnown Malware Source Similaritydist/chunks/cliLaunch-BQLM_VtG.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunks/prompt-DPZFWvZz.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/vendor/audio-capture/x64-darwin/audio-capture.node

MediumOversized Source Filedist/chunks/loadAgentsDir-DbE28Kw5.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowWeak Cryptodist/chunks/dist-es-fjXft-jH.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License