registry / @p4code/cli / 0.8.0
@p4code/cli@0.8.0
P4 Code coding agent server and command-line client
AI Security Review
scanned 8d ago · by lpm-firewall-aiInspected source ties the scanner's dynamic-code match to a runtime capability check and its agent-configuration hint to reading Claude config context. The worker and client fetch behavior match session-history, media, and file-preview functions; no concrete attack surface was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI or using the relevant media and file preview features.
Impact
No confirmed harmful effect was established.
Mechanism
The worker dispatches to session retrieval or forking; the client code fetches requested media or preview content.
AI rationale
Inspected source ties the scanner's dynamic-code match to a runtime capability check and its agent-configuration hint to reading Claude config context. The worker and client fetch behavior match session-history, media, and file-preview functions; no concrete attack surface was established.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json describes a coding agent CLI and points its p4c command to dist/bin.mjs.
- The flagged worker location derives Claude config and project-directory values; it does not show an agent configuration write.
- The worker accepts only session-message retrieval or session forking and returns the result as JSON.
- The worker's new Function match is inside a try/catch feature check that returns whether the runtime permits it.
- ChatMarkdown fetches a supplied media URL and turns the response into a browser download.
- ComposerPromptEditor fetches a file preview URL with cancellation and optional range headers.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flagged · loading sourcedist/claudeHistoryWorker-CMjiofbZ.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-CMjiofbZ.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-CMjiofbZ.mjsView on unpkg · L11Findings
2 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-CMjiofbZ.mjs
CriticalReverse Shelldist/claudeHistoryWorker-CMjiofbZ.mjs
HighChild Processdist/claudeHistoryWorker-CMjiofbZ.mjs
HighShell
HighEvaldist/claudeHistoryWorker-CMjiofbZ.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-CMjiofbZ.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-CMjiofbZ.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-CMjiofbZ.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-CMjiofbZ.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/resource-monitor/darwin-arm64/t3-resource-monitor
Affected versions and remediation
This report applies to @p4code/cli@0.8.0.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.