•Default external logging endpoint and rich-record POST in dist/index.js:
function parseReviewResponse(raw, plan) {
message: "LLM response did not contain a JSON payload; treating all entries as approved."
const { approved, reasons } = parseReviewResponse(payload, plan);
const perm = await handle.queryPermission?.({ mode: "read" }) ?? "granted";
return "An error occurred while executing a database query.";
case "bad_request:api":
return `The request couldn't be processed. Please check your input and try again.${cause ? ` Cause: ${cause}` : ""}`;
return "The requested chat was not found. Please check the chat ID and try again.";
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg 7import * as nf from 'node-fetch';
L8: import * as fd from 'formdata-node';
L9: import KeepAliveAgent from 'agentkeepalive';
...
L21: import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L248: function getTauriDataDir() {
L249: if (process.env.TAURI_DATA_DIR) {
L250: return process.env.TAURI_DATA_DIR;
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L7 7Trigger-reachable chain: manifest.main -> dist/index.js
L7: import * as nf from 'node-fetch';
L8: import * as fd from 'formdata-node';
L9: import KeepAliveAgent from 'agentkeepalive';
...
L21: import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L248: function getTauriDataDir() {
L249: if (process.env.TAURI_DATA_DIR) {
L250: return process.env.TAURI_DATA_DIR;
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L7 21import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L21 158377var jx = {};
L158378: Dt(jx, { USE_API_CONTEXT_MANAGEMENT: () => Rle, INK_SCREEN_READER: () => Jse, FORCE_VCR: () => Cle, FORCE_PROMPT_CACHING_5M: () => Ale, FORCE_CODE_TERMINAL: () => Tle, FORCE_AUTOUP...
L158379: var Vse = p.triBool();
162127var ST = O(() => x({ source: Vp().describe("Where to fetch the marketplace from"), installLocation: g().optional().describe("Local cache path where marketplace manifest is stored (...
L162128: var vh = O(() => x({ serverName: g().regex(/^[a-zA-Z0-9_-]+$/, "Server name can only contain letters, numbers, hyphens, and underscores").optional().describe("Name of the MCP serve...
L162129: var wh = O(() => x({ serverName: g().min(1, "Server name must be non-empty").refine((e) => e.trim().length > 0, { message: "Server name must not be whitespace-only" }).refine((e) =...
...
L162134: function HG(e) {
L162135: return x({ $schema: g().optional().describe("JSON Schema reference for Claude Code settings"), apiKeyHelper: g().optional().describe("Path to a script that outputs authentication v..
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L162127 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import we__default, { constants as constants$1, realpathSync, mkdirSync, existsSync, readFileSync, copyFileSync, writeFileSync, createWriteStream, ReadStream, readdirSync } from 'f...
import { readFile as readFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, mkdir, rm, rmdir, unlink, readdir, lstat, stat as stat$1, w...
import { createInterface } from 'readline';
async function writeFile(path6, data, options) {
await writeFile(path6, data);
// Marks visible continuation messages created after an authorization card is
authorizationContinuation: z$1.boolean().optional(),
baseUR
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
import we__default, { constants as constants$1, realpathSync, mkdirSync, existsSync, readFileSync, copyFileSync, writeFileSync, createWriteStream, ReadStream, readdirSync } from 'f...
import { readFile as readFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, mkdir, rm, rmdir, unlink, readdir, lstat, stat as stat$1, w...
"follow up"
// ../../node_modules/clsx/dist/clsx.mjs
"../../node_modules/clsx/dist/clsx.mjs"() {
// ../../node_modules/tailwind-merge/dist/bundle-mjs.mjs
"../../node_modules/tailwind-merge/dist/bundle-mjs.mjs"() {
* @see https://tailwindcss.com/docs/aspect-ratio
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg 7import * as nf from 'node-fetch';
L8: import * as fd from 'formdata-node';
L9: import KeepAliveAgent from 'agentkeepalive';
...
L21: import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L248: function getTauriDataDir() {
L249: if (process.env.TAURI_DATA_DIR) {
L250: return process.env.TAURI_DATA_DIR;
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L7 7import * as nf from 'node-fetch';
L8: import * as fd from 'formdata-node';
L9: import KeepAliveAgent from 'agentkeepalive';
...
L21: import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L248: function getTauriDataDir() {
L249: if (process.env.TAURI_DATA_DIR) {
L250: return process.env.TAURI_DATA_DIR;
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L7 21import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L6692: constructor({
L6693: baseURL,
L6694: maxRetries = 2,
...
L15932: function writeFileSync2(filePath, content) {
L15933: we.writeFileSync(filePath, content);
L15934: }
...
L93078: availableTools = void 0,
L93079: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}`
L93080: }) {
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L21 7Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js
L7: import * as nf from 'node-fetch';
L8: import * as fd from 'formdata-node';
L9: import KeepAliveAgent from 'agentkeepalive';
...
L21: import * as sqliteVec from 'sqlite-vec';
L22: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L23: import * as z4 from 'zod/v4';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L248: function getTauriDataDir() {
L249: if (process.env.TAURI_DATA_DIR) {
L250: return process.env.TAURI_DATA_DIR;
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/index.jsView on unpkg · L7 •path = dist/index.js
kind = oversized_source_file
sizeBytes = 7002704
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/index.jsView on unpkg