@p4code/cli@0.4.9
P4 Code coding agent server and command-line client
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install lifecycle hook or stealth payload was found, so a publish block is not warranted. Default external telemetry derived from AI-tool account metadata remains a real privacy risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run p4c to start the server; service installation requires an explicit p4c service command.
Impact
External telemetry can link server activity to a stable account-derived identifier and device metadata.
Mechanism
Default-enabled telemetry based on hashed AI-tool account identifiers.
AI rationale
No install lifecycle hook or stealth payload was found, so a publish block is not warranted. Default external telemetry derived from AI-tool account metadata remains a real privacy risk.
Evidence
dist/bin.mjs~/.codex/auth.json~/.claude.json~/.p4/telemetry/anonymous-id
Network endpoints1
us.i.posthog.com/batch/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The running server reads the Codex authentication file and extracts its account identifier.
- It hashes a Codex or Claude account identifier and uses it as a persistent telemetry identifier.
- Telemetry is enabled by default and posts event batches, including the identifier and host metadata, to PostHog.
- An explicit service-install path can install another version of this package into a local runtime directory.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The self-install and background-service actions are reached through explicit p4c service commands, not package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Oversized source lightweight scan
dist/bin.mjs5.13 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsregistry.npmjs.org
dist/client/assets/index-BMtTA7Do.js3.91 MB file, sampled 256 KB
HighEntropyStringsMinified
Source & flagged code
23 flagged · loading sourcedist/client/assets/blade-llJRbbtR.jsView file
1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json...
L2: //# sourceMappingURL=blade-llJRbbtR.js.map
High
Child Process
Package source references child process execution.
dist/client/assets/blade-llJRbbtR.jsView on unpkg · L1dist/bin.mjsView file
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.9";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
dist/bin.mjsView on unpkg · L1313import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.9";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/bin.mjsView on unpkg · L1313Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.9";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin.mjsView on unpkg · L13•matchType = previous_version_dangerous_delta
matchedPackage = @p4code/cli@0.4.4
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.4
similarity = 0.967
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.mjsView on unpkg364const POSIX_PATH_DELIMITER = ":";
L365: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L366: function canExecuteFile(filePath) {
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/bin.mjsView on unpkg13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.9";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin.mjsView on unpkg · L1321import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3738: name: TrimmedNonEmptyString,
L3739: baseUrl: Schema$1.String
L3740: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bin.mjsView on unpkg · L2113Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L241: //#endregion
L242: //#region package.json
L243: var version = "0.4.9";
...
L376: /**
L377: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L378: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/bin.mjsView on unpkg · L13•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 9
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_source_file
sizeBytes = 5380868
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/bin.mjsView on unpkg•path = dist/bin.mjs
kind = oversized_cli_entrypoint
sizeBytes = 5380868
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/bin.mjsView on unpkgdist/client/assets/sass-DXrisJhu.jsView file
1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?e...
L2: //# sourceMappingURL=sass-DXrisJhu.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/assets/sass-DXrisJhu.jsView on unpkg · L1dist/NodePtyAdapter-BQAnH2v0.mjsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/NodePtyAdapter-BQAnH2v0.mjs
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/NodePtyAdapter-BQAnH2v0.mjsView on unpkgdist/BunPtyAdapter-CLDq7yr1.mjsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/BunPtyAdapter-CLDq7yr1.mjs
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/BunPtyAdapter-CLDq7yr1.mjsView on unpkgdist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/chunk-4I5QYGJK-CYvb6li-.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-4I5QYGJK-CYvb6li-.jsView on unpkgdist/client/assets/chunk-5RXB4S5H-BzE89W2t.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/chunk-5RXB4S5H-BzE89W2t.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-5RXB4S5H-BzE89W2t.jsView on unpkgdist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.jsView on unpkgdist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/chunk-WRU74C26-C2Rb3ATV.jsView on unpkgdist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.jsView on unpkgdist/client/assets/mdx-host-ykYobBl4.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = dist/client/assets/mdx-host-ykYobBl4.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/mdx-host-ykYobBl4.jsView on unpkgdist/client/assets/previewAssetResource-DoQeyCSk.jsView file
•matchType = normalized_sha256
matchedPackage = @p4code/cli@0.4.6
matchedPath = [redacted]-BSwDMX3X.js
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/previewAssetResource-DoQeyCSk.jsView on unpkgFindings
4 Critical16 High7 Medium3 Low
CriticalSensitive Archive Exfiltrationdist/bin.mjs
CriticalCredential Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
CriticalPrevious Version Dangerous Deltadist/bin.mjs
HighChild Processdist/client/assets/blade-llJRbbtR.js
HighShelldist/bin.mjs
HighCredential Redirect Persistencedist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighRemote Agent Bridgedist/bin.mjs
HighTrigger Reachable Credential Exfiltrationdist/bin.mjs
HighSemantic Analysis Limiteddist/bin.mjs
HighKnown Malware Source Similaritydist/NodePtyAdapter-BQAnH2v0.mjs
HighKnown Malware Source Similaritydist/BunPtyAdapter-CLDq7yr1.mjs
HighKnown Malware Source Similaritydist/client/assets/chunk-4I5QYGJK-CYvb6li-.js
HighKnown Malware Source Similaritydist/client/assets/chunk-5RXB4S5H-BzE89W2t.js
HighKnown Malware Source Similaritydist/client/assets/chunk-JQJVKLGR-oHxUxbQ4.js
HighKnown Malware Source Similaritydist/client/assets/chunk-WRU74C26-C2Rb3ATV.js
HighKnown Malware Source Similaritydist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js
HighKnown Malware Source Similaritydist/client/assets/mdx-host-ykYobBl4.js
HighKnown Malware Source Similaritydist/client/assets/previewAssetResource-DoQeyCSk.js
MediumDynamic Requiredist/client/assets/sass-DXrisJhu.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Source Filedist/bin.mjs
MediumOversized Cli Entrypointdist/bin.mjs
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @p4code/cli@0.4.9.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.4.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.