@p4code/cli@0.7.13

P4 Code coding agent server and command-line client

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the flagged source locations resolve to a frontend filename mapping, terminal adapters, and frontend assets. The default-on telemetry transmits hashed identifiers, but the inspected source does not establish credential theft or other malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The CLI telemetry service starts with telemetry enabled by default.

Impact

This supports pseudonymous product analytics; the inspected code does not send the underlying token or raw identifier.

Mechanism

It hashes a local Codex account ID or Claude user ID and sends the hash with usage events and platform metadata.

AI rationale

Evidence

package.jsondist/bin.mjs

Network endpoints1

us.i.posthog.com

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares the p4c CLI entrypoint and has no lifecycle scripts.
The requested frontend location maps claude.md to a language label; it does not configure an agent.
CLI telemetry reads Codex or Claude identifiers, hashes them with SHA-256, and sends the hash with platform metadata to PostHog.
The flagged PTY files implement process and terminal adapters.
The other flagged assets import bundled frontend, diagram, and Markdown modules; the MDX preview helper fetches metadata and loads its configured document module.

Evidence against

Telemetry is enabled by default and sends a hashed account or user identifier to the configured PostHog host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

21 flagged

dist/bin.mjsView file

3import { a as HostProcessEnvironment, c as HostProcessPlatform, i as HostProcessArguments, l as HostProcessUserId, n as PtySpawnError, o as HostProcessExecutablePath, r as HostProc... L4: import { $ as FeedError, $a as [redacted], $c as ThreadWorkspaceLifecycle, $i as DesktopTelemetryControlMessage, $l as ServerAuthSessionMethod, $n as Tick... L5: import { a as documentContentDigest, c as parseDesign, d as reviewState, f as selectLayoutItems, i as diagnostic, l as patchNode, m as validateDesign, n as canonicalSerialize, o as... ... L23: import * as NodePath from "node:path"; L24: import * as NodeChildProcess from "node:child_process"; L25: import * as NodeFS from "node:fs"; ... L262: //#endregion L263: //#region package.json L264: var version$1 = "0.7.13"; ... L408: /** L409: * Escapes

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> dist/bin.mjs L3: import { a as HostProcessEnvironment, c as HostProcessPlatform, i as HostProcessArguments, l as HostProcessUserId, n as PtySpawnError, o as HostProcessExecutablePath, r as HostProc... L4: import { $ as FeedError, $a as [redacted], $c as ThreadWorkspaceLifecycle, $i as DesktopTelemetryControlMessage, $l as ServerAuthSessionMethod, $n as Tick... L5: import { a as documentContentDigest, c as parseDesign, d as reviewState, f as selectLayoutItems, i as diagnostic, l as patchNode, m as validateDesign, n as canonicalSerialize, o as... ... L23: import * as NodePath from "node:path"; L24: import * as NodeChildProcess from "node:child_process"; L25: import * as NodeFS from "node:fs"; ... L262: //#endregion L263: //#region package.json L264: v

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L3

23import * as NodePath from "node:path"; L24: import * as NodeChildProcess from "node:child_process"; L25: import * as NodeFS from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin.mjsView on unpkg · L23

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import { $ as FeedError, $a as [redacted], $c as ThreadWorkspaceLifecycle, $i as DesktopTelemetryControlMessage, $l as ServerAuthSessionMethod, $n as Tick... import * as NodeReadline from "node:readline"; }).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore); yield* fileSystem.writeFile(tempPath, value); WHEN json_type(payload_json, '$.defaultModelOptions.codex') IS NOT NULL OR json_type(payload_json, '$.defaultModelOptions.claudeAgent') IS NOT NULL WHEN json_type(payload_json, '$.defaultModelOptions.claudeAgent') IS NOT NULL json(json_extract(payload_json, '$.defaultModelOptions.clau

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.mjsView on unpkg · L3

23import * as NodePath from "node:path"; L24: import * as NodeChildProcess from "node:child_process"; L25: import * as NodeFS from "node:fs"; ... L6335: const revokeOtherClientSessions = (currentSessionId) => revokeOtherSessionsExcept(currentSessionId).pipe(Effect.withSpan("EnvironmentAuth.revokeOtherClientSessions")); L6336: const issueStartupPairingUrl = (baseUrl) => issueStartupPairingCredential().pipe(Effect.map((issued) => { L6337: const url = new URL(baseUrl); ... L35997: const dir = path.join(os.homedir(), '.p4', 'device', 'tools', name, version); L35998: try { return file(path.join(dir, 'node_modules', name, entry)) && fs.readFileSync(path.join(dir, '.install-complete'), 'utf8').trim() === version; } catch { return false; } L35999: };

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.mjsView on unpkg · L23

3Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs L3: import { a as HostProcessEnvironment, c as HostProcessPlatform, i as HostProcessArguments, l as HostProcessUserId, n as PtySpawnError, o as HostProcessExecutablePath, r as HostProc... L4: import { $ as FeedError, $a as [redacted], $c as ThreadWorkspaceLifecycle, $i as DesktopTelemetryControlMessage, $l as ServerAuthSessionMethod, $n as Tick... L5: import { a as documentContentDigest, c as parseDesign, d as reviewState, f as selectLayoutItems, i as diagnostic, l as patchNode, m as validateDesign, n as canonicalSerialize, o as... ... L23: import * as NodePath from "node:path"; L24: import * as NodeChildProcess from "node:child_process"; L25: import * as NodeFS from "node:fs"; ... L262: //#endregion L263: //#reg

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/bin.mjsView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 6845312 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 6845312 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/mdx-host-ykYobBl4.jsView file

Lines 1-4javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/Diagram-CP713Hf0.js","assets/rolldown-runtime-QTnfLwEv.js","assets/preload-helper-CEhsl8MR.js","assets/compiler-runtime-CLAvuQ-D.js"])))=>i.

dist/resource-monitor/darwin-arm64/p4-resource-monitorView file

•path = dist/resource-monitor/darwin-arm64/p4-resource-monitor kind = native_binary sizeBytes = 546160 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-arm64/p4-resource-monitorView on unpkg

dist/NodePtyAdapter-BQAnH2v0.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/NodePtyAdapter-BQAnH2v0.mjs matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High