•Default external logging endpoint and rich-record POST in dist/index.js:
const perm = await handle.queryPermission?.({ mode: "read" }) ?? "granted";
return "An error occurred while executing a database query.";
case "bad_request:api":
return `The request couldn't be processed. Please check your input and try again.${cause ? ` Cause: ${cause}` : ""}`;
return "The requested chat was not found. Please check the chat ID and try again.";
return "The requested document was not found. Please check the document ID and try again.";
case "bad_request:document":
return "The request to create or update the document was invalid. Please check your input and try again.";
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg 2import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L34: import { createRequire } from 'module';
L35: import Xoe from 'http';
L36: import Qoe from 'https';
...
L2570: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2571: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2572: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it")...
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L2 2Trigger-reachable chain: manifest.main -> dist/index.js
L2: import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L34: import { createRequire } from 'module';
L35: import Xoe from 'http';
L36: import Qoe from 'https';
...
L2570: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2571: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2572: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it")...
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L2 27import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L27 84020parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`];
L84021: parsed.command = process.env.comspec || "cmd.exe";
L84022: parsed.options.windowsVerbatimArguments = true;
159865var ST = O(() => x({ source: Vp().describe("Where to fetch the marketplace from"), installLocation: g().optional().describe("Local cache path where marketplace manifest is stored (...
L159866: var vh = O(() => x({ serverName: g().regex(/^[a-zA-Z0-9_-]+$/, "Server name can only contain letters, numbers, hyphens, and underscores").optional().describe("Name of the MCP serve...
L159867: var wh = O(() => x({ serverName: g().min(1, "Server name must be non-empty").refine((e) => e.trim().length > 0, { message: "Server name must not be whitespace-only" }).refine((e) =...
...
L159872: function HG(e) {
L159873: return x({ $schema: g().optional().describe("JSON Schema reference for Claude Code settings"), apiKeyHelper: g().optional().describe("Path to a script that outputs authentication v..
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L159865 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import we__default, { constants as constants$1, realpathSync, mkdirSync, existsSync, readFileSync, copyFileSync, writeFileSync, promises, createWriteStream, readdirSync, ReadStream...
import { readFile as readFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, mkdir, rm, rmdir, unlink, readdir, lstat, stat as stat$1, w...
import { createInterface } from 'readline';
async function writeFile(path6, data, options) {
await writeFile(path6, data);
// Marks visible continuation messages created after an authorization card is
authorizationContinuation: z$1.boolean().optional(),
baseUR
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
import we__default, { constants as constants$1, realpathSync, mkdirSync, existsSync, readFileSync, copyFileSync, writeFileSync, promises, createWriteStream, readdirSync, ReadStream...
import { readFile as readFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, mkdir, rm, rmdir, unlink, readdir, lstat, stat as stat$1, w...
// ../../node_modules/clsx/dist/clsx.mjs
"../../node_modules/clsx/dist/clsx.mjs"() {
// ../../node_modules/tailwind-merge/dist/bundle-mjs.mjs
"../../node_modules/tailwind-merge/dist/bundle-mjs.mjs"() {
* @see https://tailwindcss.com/docs/aspect-ratio
* @see https://tailwindcss.com
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg 2import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L34: import { createRequire } from 'module';
L35: import Xoe from 'http';
L36: import Qoe from 'https';
...
L2570: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2571: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2572: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it")...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L2 2import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L34: import { createRequire } from 'module';
L35: import Xoe from 'http';
L36: import Qoe from 'https';
...
L2570: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2571: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2572: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it")...
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L2 27import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L5776: constructor({
L5777: baseURL,
L5778: maxRetries = 2,
...
L15016: function writeFileSync2(filePath, content) {
L15017: we.writeFileSync(filePath, content);
L15018: }
...
L79818: availableTools = void 0,
L79819: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}`
L79820: }) {
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L27 2Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js
L2: import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, execSync, spawn, execFileSync, exec } from 'child_process';
L29: import hne, { fileURLToPath } from 'url';
...
L34: import { createRequire } from 'module';
L35: import Xoe from 'http';
L36: import Qoe from 'https';
...
L2570: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2571: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2572: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare i
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.jsView on unpkg · L2 •path = dist/index.js
kind = oversized_source_file
sizeBytes = 6803329
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/index.jsView on unpkg