@p4code/cli: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@p4code/cli: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

17 flagged · loading source

dist/client/assets/blade-llJRbbtR.jsView file

1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json... L2: //# sourceMappingURL=blade-llJRbbtR.js.map

High

Child Process

Package source references child process execution.

dist/client/assets/blade-llJRbbtR.jsView on unpkg · L1

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L13

363const POSIX_PATH_DELIMITER = ":"; L364: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L365: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L363

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String authorization: Schema$1.optionalKey(Schema$1.String), httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, httpBaseUrl: Schema$1.NullOr(Schema$1.String),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L13

21import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L3682: name: TrimmedNonEmptyString, L3683: baseUrl: Schema$1.String L3684: });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L21

13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L13

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 5331517 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 5331517 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/sass-DXrisJhu.jsView file

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?e... L2: //# sourceMappingURL=sass-DXrisJhu.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/sass-DXrisJhu.jsView on unpkg · L1

dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-HOUHSVGY-msG2U0fQ.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView on unpkg

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkg

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkg

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/public/assets/diagram-G4DWMVQ6-Ba38EFwg.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkg

Source & flagged code

17 flagged

dist/client/assets/blade-llJRbbtR.jsView file

Lines 1-2javascript

1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json-Bg9ijW3F.js";import a from"./html-derivative-CY6NRz-J.js";import{t as o}from"./sql-DNssxck8.js";var s=Object.freeze(JSON.parse(`{"displayName":"Blade","fileTypes":["blade.php"],"foldingStartMarker":"(/\\\\*|\\\\{\\\\s*$|<<<HTML)","foldingStopMarker":"(\\\\*/|^\\\\s*}|^HTML;)","injections":{"text.html.php.blade - (meta.embedded | meta.tag | comment.block.blade), L:(text.html.php.blade meta.tag - (comment.block.blade ...

2//# sourceMappingURL=blade-llJRbbtR.js.map

High

Child Process

Package source references child process execution.

dist/client/assets/blade-llJRbbtR.jsView on unpkg · L1

Long lines were clipped for display.

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L240: //#endregion L241: //#region package.json L242: var version = "0.4.6"; ... L375: /** L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L377: * on Windows). Node joins the command and arguments with spaces and hands the

dist/client/assets/sass-DXrisJhu.jsView file

Lines 1-2javascript

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?endregion|^\\\\s*$","name":"sass","patterns":[{"begin":"^(

dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-HOUHSVGY-msG2U0fQ.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView on unpkg

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkg

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkg

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/public/assets/diagram-G4DWMVQ6-Ba38EFwg.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkg