registry / @p4code/cli / 0.3.17

@p4code/cli@0.3.17

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a user-invoked CLI that can optionally install its own per-user service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running `p4c`; persistence requires the explicit `p4c service install` command.

Impact

It can run a local coding-agent server and, when requested, keep that server running for the user.

Mechanism

CLI server with optional per-user service setup.

Rationale

Source inspection found no npm lifecycle hook, credential archive, or credential upload. The observed network request is a bounded npm version check, while persistence is behind an explicit CLI command.

Evidence

package.jsondist/bin.mjs

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

The optional service command writes and enables a per-user background service.
The CLI entrypoint runs only when the installed binary is invoked.

Evidence against

The manifest has no preinstall, install, postinstall, or other lifecycle script.
No source evidence supports the scanner claim of credential archiving or registry upload; the observed registry request is a version check.
The service installation path is an explicit `p4c service install` command, not an npm-install side effect.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 495 file(s), 16.8 MB of source, external domains: 127.0.0.1, api.meta.ai, chevrotain.io, en.wikipedia.org, github.com, langium.org, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

17 flagged

dist/client/assets/blade-llJRbbtR.jsView file

Lines 1-2javascript

1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json-Bg9ijW3F.js";import a from"./html-derivative-CY6NRz-J.js";import{t as o}from"./sql-DNssxck8.js";var s=Object.freeze(JSON.parse(`{"displayName":"Blade","fileTypes":["blade.php"],"foldingStartMarker":"(/\\\\*|\\\\{\\\\s*$|<<<HTML)","foldingStopMarker":"(\\\\*/|^\\\\s*}|^HTML;)","injections":{"text.html.php.blade - (meta.embedded | meta.tag | comment.block.blade), L:(text.html.php.blade meta.tag - (comment.block.blade ...

2//# sourceMappingURL=blade-llJRbbtR.js.map

High

Child Process

Package source references child process execution.

dist/client/assets/blade-llJRbbtR.jsView on unpkg · L1

Long lines were clipped for display.

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.17"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L21: import * as NodePath from "node:path"; L22: import * as NodeChildProcess from "node:child_process"; L23: import * as NodeFS from "node:fs"; ... L239: //#endregion L240: //#region package.json L241: var version = "0.3.17"; ... L374: /** L375: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L376: * on Windows). Node joins the command and arguments with spaces and hands the

dist/client/assets/sass-DXrisJhu.jsView file

Lines 1-2javascript

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?endregion|^\\\\s*$","name":"sass","patterns":[{"begin":"^(

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkg

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkg

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/public/assets/diagram-G4DWMVQ6-Ba38EFwg.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkg

Source & flagged code

17 flagged · loading source

dist/client/assets/blade-llJRbbtR.jsView file

High

Child Process

Package source references child process execution.

dist/client/assets/blade-llJRbbtR.jsView on unpkg · L1

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

Findings

3 Critical11 High7 Medium3 Low

CriticalSensitive Archive Exfiltrationdist/bin.mjs

CriticalCredential Exfiltrationdist/bin.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs

HighChild Processdist/client/assets/blade-llJRbbtR.js

HighShelldist/bin.mjs

HighCredential Redirect Persistencedist/bin.mjs

HighEntrypoint Foreign Package Code Overwritedist/bin.mjs

HighCommand Output Exfiltrationdist/bin.mjs

HighRemote Agent Bridgedist/bin.mjs

HighTrigger Reachable Credential Exfiltrationdist/bin.mjs

HighSemantic Analysis Limiteddist/bin.mjs

HighKnown Malware Source Similarity