@p4code/cli@0.6.22

P4 Code coding agent server and command-line client

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The package has concrete agent configuration and runtime-install capabilities, but no evidence of an automatic lifecycle attack, credential theft, or covert exfiltration. Treat this as a guarded agent-extension risk rather than malware.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Using the CLI's agent or server-management functionality.

Impact

These capabilities could affect agent behavior when invoked; no covert execution during npm installation was established.

Mechanism

It updates MCP server entries, replaces managed skill directories, and can install a pinned package runtime.

AI rationale

Evidence

dist/bin.mjs

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Package metadata exposes a command-line entry point and contains no lifecycle hook.
The command bundle can rewrite Claude MCP server configuration files.
The command bundle can replace managed agent skill directories.
A server-runtime path installs a pinned release of this package with npm.

Evidence against

No install-time lifecycle hook was found.
The identified client assets are a file-icon mapping and an API schema, not configuration writes.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 495 file(s), 16.9 MB of source, external domains: 127.0.0.1, api.meta.ai, asset.invalid, base-ui.com, chevrotain.io, cli.github.com, en.wikipedia.org, github.com, gitlab.com, langium.org, p4.chat, p4.codes, react.dev, registry.npmjs.org, www.w3.org

Source & flagged code

22 flagged

dist/bin.mjsView file

13import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L22: import { isAbsolute } from "node:path"; L23: import * as NodeChildProcess from "node:child_process"; L24: import { spawn } from "node:child_process"; ... L269: //#endregion L270: //#region package.json L271: var version$1 = "0.6.22"; ... L404: /** L405: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L406: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L13

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L22: import { isAbsolute } from "node:path"; L23: import * as NodeChildProcess from "node:child_process"; L24: import { spawn } from "node:child_process"; ... L269: //#endregion L270: //#region package.json L271: var version$1 = "0.6.22"; ... L404: /** L405: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L406: * on Windows). Node joins the command and arguments with spaces and hands the

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L13

22import { isAbsolute } from "node:path"; L23: import * as NodeChildProcess from "node:child_process"; L24: import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/bin.mjsView on unpkg · L22

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String authorization: Schema$1.optionalKey(Schema$1.String), httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, httpBaseUrl: Schema$1.NullOr(Schema$1.String),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L13

22import { isAbsolute } from "node:path"; L23: import * as NodeChildProcess from "node:child_process"; L24: import { spawn } from "node:child_process"; ... L1584: name: TrimmedNonEmptyString, L1585: baseUrl: Schema$1.String L1586: }); ... L51274: const dir = path.join(os.homedir(), '.p4', 'device', 'tools', name, version); L51275: try { return file(path.join(dir, 'node_modules', name, entry)) && fs.readFileSync(path.join(dir, '.install-complete'), 'utf8').trim() === version; } catch { return false; } L51276: };

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L22

13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L13: import * as NodeOS from "node:os"; L14: import * as NodeNet from "node:net"; L15: import * as Data from "effect/Data"; ... L22: import { isAbsolute } from "node:path"; L23: import * as NodeChildProcess from "node:child_process"; L24: import { spawn } from "node:child_process"; ... L269: //#endregion L270: //#region package.json L271: var version$1 = "0.6.22"; ... L404: /** L405: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })` L406: * on Windows). Node joins the command and arguments with spaces and hands the

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L13

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 7018034 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 7018034 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/mdx-host-ykYobBl4.jsView file

Lines 1-4javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/Diagram-CP713Hf0.js","assets/rolldown-runtime-QTnfLwEv.js","assets/preload-helper-CEhsl8MR.js","assets/compiler-runtime-CLAvuQ-D.js"])))=>i.

dist/resource-monitor/darwin-x64/p4-resource-monitorView file

•path = dist/resource-monitor/darwin-x64/p4-resource-monitor kind = native_binary sizeBytes = 575344 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-x64/p4-resource-monitorView on unpkg

dist/NodePtyAdapter-BQAnH2v0.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/NodePtyAdapter-BQAnH2v0.mjs matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High