P4 Code coding agent server and command-line client
AI Security Review
scanned 2mo ago · by lpm-firewall-ai
The package does not show install-time malware or token theft, but its default collection and external transmission of identifiers sourced from other AI-tool configuration files is a concrete privacy risk. This warrants a warning rather than a block.
A user runs the p4c CLI and starts its server runtime.
Impact
A remote analytics service receives a stable identifier linked to AI-tool account data and runtime activity metadata.
Mechanism
Hashing AI-tool account identifiers and posting telemetry batches.
AI rationale
The package does not show install-time malware or token theft, but its default collection and external transmission of identifiers sourced from other AI-tool configuration files is a concrete privacy risk. This warrants a warning rather than a block.
1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json...
L2: //# sourceMappingURL=blade-llJRbbtR.js.map
High
Child Process
Package source references child process execution.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
13Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
21import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3738: name: TrimmedNonEmptyString,
L3739: baseUrl: Schema$1.String
L3740: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json-Bg9ijW3F.js";import a from"./html-derivative-CY6NRz-J.js";import{t as o}from"./sql-DNssxck8.js";var s=Object.freeze(JSON.parse(`{"displayName":"Blade","fileTypes":["blade.php"],"foldingStartMarker":"(/\\\\*|\\\\{\\\\s*$|<<<HTML)","foldingStopMarker":"(\\\\*/|^\\\\s*}|^HTML;)","injections":{"text.html.php.blade - (meta.embedded | meta.tag | comment.block.blade), L:(text.html.php.blade meta.tag - (comment.block.blade ...
2//# sourceMappingURL=blade-llJRbbtR.js.map
High
Child Process
Package source references child process execution.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
13Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
21import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3738: name: TrimmedNonEmptyString,
L3739: baseUrl: Schema$1.String
L3740: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.10";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.