registry / @p4code/cli / 0.2.32

@p4code/cli@0.2.32

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-run coding-agent server and has an explicit per-user service-install command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `p4c service install` or starts the CLI.

Impact

No unconsented install-time persistence, credential exfiltration, or remote payload execution found.

Mechanism

Explicit CLI service setup and advisory version check.

Rationale

The scanner's archive/credential-exfiltration claim is not supported by the inspected bundle. Observed persistence and networking are documented, package-aligned, and user-invoked.

Evidence

package.jsondist/bin.mjsREADME.md

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked `p4c service install` can create a per-user background service.
CLI performs an advisory npm-registry version check.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
No source evidence of archiving sensitive configuration or sending credentials to a registry endpoint.
The service persistence is an explicit CLI subcommand, not install-time execution or foreign agent-config mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 496 file(s), 16.8 MB of source, external domains: chevrotain.io, en.wikipedia.org, github.com, langium.org, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

17 flagged

dist/client/assets/index-rdR8RpSW.jsView file

482?|[ L483: \v\f\u2028\u2029])`),t));else if(c===`posix`)if(!i&&(u===`graph`||u===`print`)){if(r===`strict`)throw Error(`POSIX class "${u}" requires min target ES2024 or non-strict accuracy`)... L484: `)),e}var xY=Symbol(`no-token`),SY=Symbol(`multiple-tokens`);function CY(e){let t=dZe(e);if(t!=null)return t;let n=xY,r=[],i=[],a,o=()=>{if(i.length===0||a==null){i=[],a=void 0;ret...

High

Child Process

Package source references child process execution.

dist/client/assets/index-rdR8RpSW.jsView on unpkg · L482

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.2.32"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.2.32"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L13

362const POSIX_PATH_DELIMITER = ":"; L363: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L364: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L362

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String authorization: Schema$1.optionalKey(Schema$1.String), httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, httpBaseUrl: Schema$1.NullOr(Schema$1.String),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bin.mjs: const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME$1)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json")); }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); missing: "GitHub CLI (`gh`) is required to browse change requests on this host. Install it from https://cli.github.com/ and reload.", missing: "GitLab CLI (`glab`) is required to browse change requests on this host. Install it from https://gitlab.com/gitlab-org/cli and reload.", * fixed size while fill mode follows a narrow panel. Keep measurement url: Schema.optional(BoundedU

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L13

21import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L3459: name: TrimmedNonEmptyString, L3460: baseUrl: Schema$1.String L3461: });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L21

13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.2.32"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L13

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 5126939 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 5126939 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/sass-DXrisJhu.jsView file

Lines 1-2javascript

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?endregion|^\\\\s*$","name":"sass","patterns":[{"begin":"^(

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkg

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkg

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/public/assets/diagram-G4DWMVQ6-Ba38EFwg.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkg

Source & flagged code

17 flagged · loading source

dist/client/assets/index-rdR8RpSW.jsView file

High

Child Process

Package source references child process execution.

dist/client/assets/index-rdR8RpSW.jsView on unpkg · L482

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

Findings

3 Critical11 High7 Medium3 Low

CriticalSensitive Archive Exfiltrationdist/bin.mjs

CriticalCredential Exfiltrationdist/bin.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs

HighChild Processdist/client/assets/index-rdR8RpSW.js

HighShelldist/bin.mjs

HighCredential Redirect Persistencedist/bin.mjs

HighEntrypoint Foreign Package Code Overwritedist/bin.mjs

HighCommand Output Exfiltrationdist/bin.mjs

HighRemote Agent Bridgedist/bin.mjs

HighTrigger Reachable Credential Exfiltrationdist/bin.mjs

HighSemantic Analysis Limiteddist/bin.mjs

HighKnown Malware Source Similarity