Loading npm security reports…

@p4code/cli@0.3.13: Suspicious npm security report (Warn) | LPM Firewall

registry / @p4code/cli / 0.3.13

@p4code/cli@0.3.13

AI Security Review

scanned 10d ago · by lpm-firewall-ai

At runtime, the server derives a telemetry identifier from local Codex or Claude account metadata and sends event batches to PostHog. It also supports an explicitly invoked persistent background service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running the P4Code server with default telemetry enabled; persistence requires a service command.

Impact

A third party can receive a stable identifier linked to a local Codex or Claude account, plus event and platform metadata.

Mechanism

Default outbound telemetry using a hash of local AI-tool account identifiers.

Rationale

The package has no install-time hook, but it performs default third-party telemetry tied to identifiers taken from foreign AI-tool authentication configuration. This is a concrete privacy and data-export risk, though not proven credential theft.

Evidence

package.jsondist/bin.mjs~/.codex/auth.json~/.claude.json~/.p4/telemetry/anonymous-id

Network endpoints1

us.i.posthog.com/batch/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with false-positive risk.

Source & flagged code

17 flagged · loading source

dist/client/assets/index-BcOqQm9J.jsView file

482?|[ L483: \v\f\u2028\u2029])`),t));else if(c===`posix`)if(!i&&(u===`graph`||u===`print`)){if(r===`strict`)throw Error(`POSIX class "${u}" requires min target ES2024 or non-strict accuracy`)... L484: `)),e}var AK=Symbol(`no-token`),jK=Symbol(`multiple-tokens`);function MK(e){let t=b0e(e);if(t!=null)return t;let n=AK,r=[],i=[],a,o=()=>{if(i.length===0||a==null){i=[],a=void 0;ret...

High

Child Process

Package source references child process execution.

dist/client/assets/index-BcOqQm9J.jsView on unpkg · L482

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.13"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.13"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.13"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L13

362const POSIX_PATH_DELIMITER = ":"; L363: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L364: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L362

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String authorization: Schema$1.optionalKey(Schema$1.String), httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, httpBaseUrl: Schema$1.NullOr(Schema$1.String),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bin.mjs: const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME$1)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json")); }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); missing: "GitHub CLI (`gh`) is required to browse change requests on this host. Install it from https://cli.github.com/ and reload.", missing: "GitLab CLI (`glab`) is required to browse change requests on this host. Install it from https://gitlab.com/gitlab-org/cli and reload.", * fixed size while fill mode follows a narrow panel. Keep measurement url: Schema.optional(BoundedU

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bin.mjsView on unpkg

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.13"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L13

21import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L3481: name: TrimmedNonEmptyString, L3482: baseUrl: Schema$1.String L3483: });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L21

13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.13"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L13

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 5205412 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 5205412 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/sass-DXrisJhu.jsView file

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?e... L2: //# sourceMappingURL=sass-DXrisJhu.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/sass-DXrisJhu.jsView on unpkg · L1

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkg

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkg

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/public/assets/diagram-G4DWMVQ6-Ba38EFwg.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkg