registry / @p4code/cli / 0.8.1
@p4code/cli@0.8.1
P4 Code coding agent server and command-line client
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged worker code resolves to a CLI history feature and Claude directory handling. The evaluation and socket indicators are bounded checks, and the inspected client code handles sanitized rendering and file previews; no concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI history command.
Impact
No malicious impact was identified; history results are returned to the invoking process.
Mechanism
The worker validates the requested history operation and session identifier, reads or forks local session data, and returns the result to its caller.
AI rationale
The manifest has no install hook, and the flagged worker code resolves to a CLI history feature and Claude directory handling. The evaluation and socket indicators are bounded checks, and the inspected client code handles sanitized rendering and file previews; no concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json declares the p4c entrypoint and contains no lifecycle hook.
- The reported agent-related code resolves the configured Claude directory and project name.
- The history worker handles session reading or forking, loads local session data, and returns JSON to its caller; the CLI dispatches it through a hidden subcommand.
- The apparent evaluation check only tests whether an empty function can be constructed; the socket helper makes a short connection probe and destroys the socket.
- The client assets sanitize rendered content and use range requests to load file previews.
Evidence against
- The bundle includes process and network APIs, and the worker can read Claude session history; these capabilities match the CLI’s functions and do not establish malicious behavior.
- Static indicators include a function-construction check and socket connection code, but the inspected code does not show downloaded-code execution or a reverse shell.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
14 flagged · loading sourcedist/claudeHistoryWorker-v_0uyLGp.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L11Findings
3 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalReverse Shelldist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalPrevious Version Dangerous Deltadist/claudeHistoryWorker-v_0uyLGp.mjs
HighChild Processdist/claudeHistoryWorker-v_0uyLGp.mjs
HighShell
HighEvaldist/claudeHistoryWorker-v_0uyLGp.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-v_0uyLGp.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-v_0uyLGp.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-v_0uyLGp.mjs
MediumNetwork
Affected versions and remediation
This report applies to @p4code/cli@0.8.1.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.