13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L22: import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L266: //#endregion
L267: //#region package.json
L268: var version$1 = "0.5.6";
...
L401: /**
L402: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L403: * on Windows). Node joins the command and arguments with spaces and hands the
CriticalSensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
dist/bin.mjsView on unpkg · L13 13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L22: import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L266: //#endregion
L267: //#region package.json
L268: var version$1 = "0.5.6";
...
L401: /**
L402: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L403: * on Windows). Node joins the command and arguments with spaces and hands the
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/bin.mjsView on unpkg · L13 13Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L22: import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L266: //#endregion
L267: //#region package.json
L268: var version$1 = "0.5.6";
...
L401: /**
L402: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L403: * on Windows). Node joins the command and arguments with spaces and hands the
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin.mjsView on unpkg · L13 •matchType = previous_version_dangerous_delta
matchedPackage = @p4code/cli@0.5.3
matchedIdentity = npm:QHA0Y29kZS9jbGk:0.5.3
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.mjsView on unpkg 389const POSIX_PATH_DELIMITER = ":";
L390: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"];
L391: function canExecuteFile(filePath) {
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/bin.mjsView on unpkg 13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L22: import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L266: //#endregion
L267: //#region package.json
L268: var version$1 = "0.5.6";
...
L401: /**
L402: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L403: * on Windows). Node joins the command and arguments with spaces and hands the
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/bin.mjsView on unpkg · L13 22import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L1851: name: TrimmedNonEmptyString,
L1852: baseUrl: Schema$1.String
L1853: });
...
L47717: const dir = path.join(os.homedir(), '.p4', 'device', 'tools', name, version);
L47718: try { return file(path.join(dir, 'node_modules', name, entry)) && fs.readFileSync(path.join(dir, '.install-complete'), 'utf8').trim() === version; } catch { return false; }
L47719: };
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/bin.mjsView on unpkg · L22 13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L22: import { isAbsolute } from "node:path";
L23: import * as NodeChildProcess from "node:child_process";
L24: import { spawn } from "node:child_process";
...
L266: //#endregion
L267: //#region package.json
L268: var version$1 = "0.5.6";
...
L401: /**
L402: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L403: * on Windows). Node joins the command and arguments with spaces and hands the
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/bin.mjsView on unpkg · L13 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 8
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/bin.mjsView on unpkg •path = dist/bin.mjs
kind = oversized_source_file
sizeBytes = 6468524
magicHex = [redacted]
MediumOversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/bin.mjsView on unpkg •path = dist/bin.mjs
kind = oversized_cli_entrypoint
sizeBytes = 6468524
magicHex = [redacted]
MediumOversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/bin.mjsView on unpkg