registry / Credential exfiltration / @p4code/cli
@p4code/cli
This report shows the evidence for @p4code/cli@0.4.12. 2 of 169 known versions are blocked or flagged. The newest version, 0.8.34, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a concrete, default-enabled data-exfiltration path from third-party authentication files to an external analytics service. Hashing does not remove its use as a persistent cross-session identifier.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the p4c server or a command that initializes its runtime.
Impact
Links a user's Codex or Claude account identity to package telemetry without documented consent.
Mechanism
Default-enabled collection and external transmission of hashed third-party account identifiers.
Attack narrative
The CLI selects an account ID from ~/.codex/auth.json or ~/.claude.json, hashes it, and sends it as distinct_id in PostHog batches. Telemetry defaults to enabled and records a startup heartbeat. The package README does not disclose this collection or provide a privacy explanation.
AI rationale
This is a concrete, default-enabled data-exfiltration path from third-party authentication files to an external analytics service. Hashing does not remove its use as a persistent cross-session identifier.
Evidence
dist/bin.mjs~/.codex/auth.json~/.claude.json~/.p4/telemetry/anonymous-id
Network endpoints1
us.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI reads account identifiers from Codex and Claude authentication files.
- It hashes those identifiers and uses the result as a persistent telemetry distinct ID.
- Telemetry is enabled by default and posts event batches to PostHog.
- The README contains no telemetry or privacy disclosure.
Evidence against
- package.json has no install lifecycle scripts.
- The code reads account IDs rather than authentication tokens, and hashes them before transmission.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
dist/bin.mjs5.14 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsregistry.npmjs.org
dist/client/assets/index-BvhnZNuc.js3.92 MB file, sampled 256 KB
HighEntropyStringsMinified
Source & flagged code
21 flagged · loading sourcedist/client/assets/index-BvhnZNuc.jsView file
483?|[
L484: \v\f
\u2028\u2029])`),t));else if(c===`posix`)if(!i&&(u===`graph`||u===`print`)){if(r===`strict`)throw Error(`POSIX class "${u}" requires min target ES2024 or non-strict accuracy`)...
L485: `)),e}var UK=Symbol(`no-token`),WK=Symbol(`multiple-tokens`);function GK(e){let t=_2e(e);if(t!=null)return t;let n=UK,r=[],i=[],a,o=()=>{if(i.length===0||a==null){i=[],a=void 0;ret...
High
Child Process
Package source references child process execution.
dist/client/assets/index-BvhnZNuc.jsView on unpkg · L483dist/bin.mjsView file
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.12";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
dist/bin.mjsView on unpkg · L1313import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.12";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/bin.mjsView on unpkg · L1313Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.12";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin.mjsView on unpkg · L13•matchType = previous_version_dangerous_delta
matchedPackage = @p4code/cli@0.4.14
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.14
similarity = 0.967
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.mjsView on unpkg364const POSIX_PATH_DELIMITER = ":";
L365: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L366: function canExecuteFile(filePath) {
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/bin.mjsView on unpkg13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.12";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin.mjsView on unpkg · L1321import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3738: name: TrimmedNonEmptyString,
L3739: baseUrl: Schema$1.String
L3740: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bin.mjsView on unpkg · L2113Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.12";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/bin.mjsView on unpkg · L13•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_source_file
sizeBytes = 5391202
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_cli_entrypoint
sizeBytes = 5391202
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/bin.mjsView on unpkgdist/NodePtyAdapter-BQAnH2v0.mjsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/NodePtyAdapter-BQAnH2v0.mjs
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/NodePtyAdapter-BQAnH2v0.mjsView on unpkgdist/BunPtyAdapter-CLDq7yr1.mjsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/BunPtyAdapter-CLDq7yr1.mjs
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/BunPtyAdapter-CLDq7yr1.mjsView on unpkgdist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView file
•matchType = normalized_sha256
matchedPackage = @co0ontty/wand@4.57.0
matchedPath = vendor/codex-taskboard/dist/web/assets/chunk-4I5QYGJK-kNoGFqr0.js
matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView on unpkgdist/client/assets/chunk-5RXB4S5H-BzE89W2t.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/chunk-5RXB4S5H-BzE89W2t.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-5RXB4S5H-BzE89W2t.jsView on unpkgdist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file
•matchType = normalized_sha256
matchedPackage = @co0ontty/wand@4.57.0
matchedPath = vendor/codex-taskboard/dist/web/assets/chunk-WRU74C26-B7SBmP0K.js
matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkgdist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file
•matchType = normalized_sha256
matchedPackage = @co0ontty/wand@4.57.0
matchedPath = vendor/codex-[redacted]-Q27KOJAE-DUGCuGd9.js
matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkgdist/client/assets/mdx-host-ykYobBl4.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/mdx-host-ykYobBl4.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/mdx-host-ykYobBl4.jsView on unpkgdist/client/assets/previewAssetResource-CVDZ-YAw.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = [redacted]-BSwDMX3X.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/previewAssetResource-CVDZ-YAw.jsView on unpkgFindings
4 Critical15 High5 Medium3 Low
CriticalSensitive Archive Exfiltrationdist/bin.mjs
CriticalCredential Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
CriticalPrevious Version Dangerous Deltadist/bin.mjs
HighChild Processdist/client/assets/index-BvhnZNuc.js
HighShelldist/bin.mjs
HighCredential Redirect Persistencedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighTrigger Reachable Credential Exfiltrationdist/bin.mjs
HighSemantic Analysis Limiteddist/bin.mjs
HighKnown Malware Source Similaritydist/NodePtyAdapter-BQAnH2v0.mjs
HighKnown Malware Source Similaritydist/BunPtyAdapter-CLDq7yr1.mjs
HighKnown Malware Source Similaritydist/client/assets/chunk-4I5QYGJK-CYvb6li-.js
HighKnown Malware Source Similaritydist/client/assets/chunk-5RXB4S5H-BzE89W2t.js
HighKnown Malware Source Similaritydist/client/assets/chunk-WRU74C26-C2Rb3ATV.js
HighKnown Malware Source Similaritydist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js
HighKnown Malware Source Similaritydist/client/assets/mdx-host-ykYobBl4.js
HighKnown Malware Source Similaritydist/client/assets/previewAssetResource-CVDZ-YAw.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/bin.mjs
MediumOversized Cli Entrypointdist/bin.mjs
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @p4code/cli@0.4.12.
The versions list below shows the verdict for each recorded version.
- Avoid installing @p4code/cli@0.4.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
169 known versions0.8.34latestManual Review—AllowUnder ReviewOct 22, 2026, 9:11 AM0.8.32Manual Review—AllowUnder ReviewOct 21, 2026, 2:54 PM0.8.31Manual Review—AllowUnder ReviewOct 21, 2026, 2:19 PM0.8.30Manual Review—AllowUnder ReviewOct 21, 2026, 10:26 AM0.8.28Manual Review—AllowUnder ReviewOct 21, 2026, 5:19 AM0.8.26Manual Review—AllowUnder ReviewOct 20, 2026, 7:38 AM0.8.25Manual Review—AllowUnder ReviewOct 20, 2026, 4:56 AM0.8.24Manual Review—AllowUnder ReviewOct 20, 2026, 3:54 AM0.8.23Manual Review—AllowUnder ReviewOct 19, 2026, 2:48 PM0.8.22Manual Review—AllowUnder ReviewOct 19, 2026, 6:29 AM0.8.21Manual Review—AllowUnder ReviewOct 19, 2026, 4:33 AM0.8.20Manual Review—AllowUnder ReviewOct 19, 2026, 3:18 AM0.8.19Manual Review—AllowUnder ReviewOct 18, 2026, 2:31 PM0.8.18Clean—AllowPublishedOct 18, 2026, 7:23 AM0.8.17Clean—AllowPublishedOct 18, 2026, 6:03 AM0.8.16Manual Review—AllowUnder ReviewOct 18, 2026, 4:33 AM0.8.15Manual Review—AllowUnder ReviewOct 18, 2026, 3:38 AM0.8.14Clean—AllowPublishedOct 17, 2026, 6:30 PM0.8.13Manual Review—AllowUnder ReviewOct 17, 2026, 6:08 PM0.8.12Clean—AllowPublishedOct 17, 2026, 11:55 AM0.8.11Manual Review—AllowUnder ReviewOct 17, 2026, 10:49 AM0.8.10Clean—AllowPublishedOct 17, 2026, 10:29 AM0.8.8Manual Review—AllowUnder ReviewOct 17, 2026, 5:07 AM0.8.7Manual Review—AllowUnder ReviewOct 16, 2026, 6:07 PM0.8.6Clean—AllowPublishedOct 16, 2026, 9:34 AM0.8.5Clean—AllowPublishedOct 16, 2026, 5:02 AM0.8.4Clean—AllowPublishedOct 16, 2026, 3:19 AM0.8.3Clean—AllowPublishedOct 16, 2026, 1:18 AM0.8.1Clean—AllowPublishedOct 15, 2026, 8:59 AM0.8.0Clean—AllowPublishedOct 15, 2026, 4:39 AM0.7.13Clean—AllowPublishedOct 14, 2026, 9:25 AM0.7.12Clean—AllowPublishedOct 14, 2026, 8:33 AM0.7.11Clean—AllowPublishedOct 14, 2026, 3:57 AM0.7.9Clean—AllowPublishedOct 13, 2026, 4:53 AM0.7.8Clean—AllowPublishedOct 13, 2026, 2:46 AM0.7.7Clean—AllowPublishedOct 12, 2026, 5:24 PM0.7.6Clean—AllowPublishedOct 12, 2026, 2:33 PM0.7.5Clean—AllowPublishedOct 12, 2026, 2:17 PM0.7.3Clean—AllowPublishedOct 12, 2026, 1:14 AM0.7.2Clean—AllowPublishedOct 10, 2026, 8:22 AM0.7.0SuspiciousAI-agent capability abuseWarnPublishedOct 9, 2026, 3:10 PM0.6.54Clean—AllowPublishedOct 9, 2026, 3:47 AM0.6.53SuspiciousAI-agent capability abuseWarnPublishedOct 8, 2026, 5:09 AM0.6.50SuspiciousAI-agent capability abuseWarnPublishedOct 7, 2026, 9:07 AM0.6.48SuspiciousAI-agent capability abuseWarnPublishedOct 6, 2026, 4:33 PM0.6.46SuspiciousAI-agent capability abuseWarnPublishedOct 6, 2026, 4:13 AM0.6.43SuspiciousAgent extension lifecycle riskWarnPublishedOct 5, 2026, 6:13 AM0.6.34SuspiciousAgent extension lifecycle riskWarnPublishedOct 2, 2026, 9:39 AM0.6.33SuspiciousAI-agent capability abuseWarnPublishedOct 2, 2026, 8:44 AM0.6.28SuspiciousAI-agent capability abuseWarnPublishedOct 1, 2026, 6:39 AM0.6.27SuspiciousAI-agent capability abuseWarnPublishedSep 30, 2026, 2:21 PM0.6.26SuspiciousAI-agent capability abuseWarnPublishedSep 30, 2026, 9:15 AM0.6.25SuspiciousAI-agent capability abuseWarnPublishedSep 30, 2026, 4:34 AM0.6.24SuspiciousAI-agent capability abuseWarnPublishedSep 30, 2026, 4:22 AM0.6.23SuspiciousAgent extension lifecycle riskWarnPublishedSep 29, 2026, 3:17 PM0.6.22SuspiciousAgent extension lifecycle riskWarnPublishedSep 29, 2026, 10:26 AM0.6.21SuspiciousAI-agent capability abuseWarnPublishedSep 29, 2026, 4:09 AM0.6.20SuspiciousAI-agent capability abuseWarnPublishedSep 29, 2026, 2:43 AM0.6.18SuspiciousAI-agent capability abuseWarnPublishedSep 28, 2026, 3:37 PM0.6.16SuspiciousAI-agent capability abuseWarnPublishedSep 28, 2026, 8:14 AM0.6.15Manual Review—AllowUnder ReviewSep 27, 2026, 2:17 PM0.6.14Manual Review—AllowUnder ReviewSep 27, 2026, 5:51 AM0.6.13Manual Review—AllowUnder ReviewSep 25, 2026, 4:13 PM0.6.9SuspiciousAgent extension lifecycle riskWarnPublishedSep 23, 2026, 4:16 PM0.6.7Manual Review—AllowUnder ReviewSep 23, 2026, 3:16 AM0.6.6Manual Review—AllowUnder ReviewSep 22, 2026, 5:17 PM0.6.5Manual Review—AllowUnder ReviewSep 22, 2026, 2:06 PM0.6.4SuspiciousAgent extension lifecycle riskWarnPublishedSep 21, 2026, 3:24 PM0.6.2SuspiciousAI-agent capability abuseWarnPublishedSep 21, 2026, 5:22 AM0.6.0SuspiciousAI-agent capability abuseWarnPublishedSep 20, 2026, 11:23 AM0.5.20SuspiciousAI-agent capability abuseWarnPublishedSep 20, 2026, 5:29 AM0.5.19Scan Failed—AllowUnder ReviewSep 19, 2026, 5:00 PM0.5.16Scan Failed—AllowUnder ReviewSep 19, 2026, 5:45 AM0.5.15Scan Failed—AllowUnder ReviewSep 19, 2026, 4:28 AM0.5.13Scan Failed—AllowUnder ReviewSep 18, 2026, 6:17 PM0.5.12Scan Failed—AllowUnder ReviewSep 18, 2026, 1:33 PM0.5.8Scan Failed—AllowUnder ReviewSep 17, 2026, 2:31 PM0.5.7Scan Failed—AllowUnder ReviewSep 17, 2026, 12:11 PM0.5.6Scan Failed—AllowUnder ReviewSep 17, 2026, 6:28 AM0.5.5Scan Failed—AllowUnder ReviewSep 16, 2026, 2:44 PM0.5.4Scan Failed—AllowUnder ReviewSep 16, 2026, 11:13 AM0.5.3SuspiciousData ExfiltrationWarnPublishedSep 15, 2026, 4:33 PM0.5.2SuspiciousAI-agent capability abuseWarnPublishedSep 15, 2026, 3:28 PM0.4.19SuspiciousAgent extension lifecycle riskWarnPublishedSep 14, 2026, 7:34 AM0.4.18SuspiciousAI-agent capability abuseWarnPublishedSep 14, 2026, 2:34 AM0.4.17SuspiciousAI-agent capability abuseWarnPublishedSep 13, 2026, 11:25 AM0.4.16SuspiciousAI-agent capability abuseWarnPublishedSep 13, 2026, 8:59 AM0.4.14SuspiciousAI-agent capability abuseWarnPublishedSep 11, 2026, 4:17 AM0.4.12shownMaliciousCredential ExfiltrationBlockPublishedSep 10, 2026, 9:55 AM0.4.11SuspiciousAI-agent capability abuseWarnPublishedSep 8, 2026, 8:48 AM0.4.10SuspiciousData ExfiltrationWarnPublishedSep 7, 2026, 5:09 PM0.4.9SuspiciousData ExfiltrationWarnPublishedSep 7, 2026, 3:08 PM0.4.8SuspiciousData ExfiltrationWarnPublishedSep 6, 2026, 5:41 AM0.4.6MaliciousData ExfiltrationBlockPublishedSep 5, 2026, 1:14 PM0.4.5Scan Failed—AllowUnder ReviewSep 5, 2026, 10:05 AM0.4.4SuspiciousData ExfiltrationWarnPublishedSep 5, 2026, 4:02 AM0.4.3SuspiciousAI-agent capability abuseWarnPublishedSep 4, 2026, 3:12 PM0.4.1SuspiciousData ExfiltrationWarnPublishedSep 4, 2026, 7:11 AM0.4.0SuspiciousData ExfiltrationWarnPublishedSep 3, 2026, 9:01 AM0.3.23SuspiciousAI-agent capability abuseWarnPublishedSep 1, 2026, 7:30 PM
Showing the 100 most recent of 169 known versions.