@p4code/cli@0.8.13

⚠ Under review

P4 Code coding agent server and command-line client

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The flagged worker matches are consistent with bundled Claude Code functionality, and no install hook or confirmed attack was found. The native resource-monitor executable could not be analyzed, leaving its behavior unresolved.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI exposes explicit commands, but the native executable's activation was not resolved.

Impact

No confirmed malicious effect; the unresolved executable prevents ruling out risk.

Mechanism

Inspected source shows ordinary CLI dispatch and Claude configuration lookup; available analysis did not establish the native executable's behavior.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 63.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json exposes a CLI and declares no lifecycle scripts.
The flagged Claude config code reads CLAUDE_CONFIG_DIR and defaults to the user's .claude directory.
P4 describes its MCP registry as P4-owned and says provider configuration is imported.
The dynamic-code match only probes whether the runtime permits Function construction.
The CLI dispatches explicit ACP commands to a bridge; the Claude worker accepts caller-provided execution options.

Evidence against

The package includes a native executable resource monitor whose behavior could not be resolved by the available artifact analysis.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

14 flagged

dist/runtime-CCVFqL3Y.mjsView file

7859patternName = generic_password severity = medium line = 7859

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/runtime-CCVFqL3Y.mjsView on unpkg · L7859

dist/AcpMcpStdioBridge-BL9bAh79.mjsView file

4import { A as fromIterable, E as fromAsyncIterable, G as mapEffect, Nn as awaitAll, Pn as await_, Pt as unwrap, dt as runForEach, p as empty, st as runCollect } from "./Stream-CX7G... L5: import * as NodeChildProcess from "node:child_process"; L6: import * as NodeReadline from "node:readline";

High

Child Process

Package source references child process execution.

dist/AcpMcpStdioBridge-BL9bAh79.mjsView on unpkg · L4

dist/claudeHistoryWorker-BvaF6m2o.mjsView file

11import { randomUUID } from "node:crypto"; L12: import * as sw from "node:child_process"; L13: import { execFile } from "node:child_process"; ... L21: import Pxe, { promisify as promisify$1 } from "util"; L22: import Gxe from "http"; L23: import Wxe from "https"; ... L187: function U(e, t, n, r, o) { L188: if (r === "m") throw TypeError("Private method is not writable"); L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter"); ... L323: try { L324: return JSON.parse(e); L325: } catch (t) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

43674try { L43675: return new Function(""), !0; L43676: } catch (e) {

High

Eval

Package source references dynamic code evaluation.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L43674

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

11import { randomUUID } from "node:crypto"; L12: import * as sw from "node:child_process"; L13: import { execFile } from "node:child_process"; ... L1147: return async () => { L1148: Eg(e.baseURL); L1149: let t = await e.identityTokenProvider(); ... L29900: var h1 = { L29901: readAutoMaster: () => readFileSync("/etc/auto_master", "utf8"), L29902: homeIsOwnMount: () => {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/claudeHistoryWorker-BvaF6m2o.mjsView on unpkg · L11

dist/resource-monitor/darwin-arm64/t3-resource-monitorView file

•path = dist/resource-monitor/darwin-arm64/t3-resource-monitor kind = native_binary sizeBytes = 546160 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/resource-monitor/darwin-arm64/t3-resource-monitorView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/binCli-B9aQxlIK.mjsView file

•path = dist/binCli-B9aQxlIK.mjs kind = oversized_source_file sizeBytes = 13869081 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/binCli-B9aQxlIK.mjsView on unpkg

•path = dist/binCli-B9aQxlIK.mjs kind = oversized_cli_entrypoint sizeBytes = 13869081 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/binCli-B9aQxlIK.mjsView on unpkg

Source & flagged code

14 flagged · loading source

dist/runtime-CCVFqL3Y.mjsView file

7859patternName = generic_password severity = medium line = 7859

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/runtime-CCVFqL3Y.mjsView on unpkg · L7859

dist/AcpMcpStdioBridge-BL9bAh79.mjsView file

High

Child Process

Package source references child process execution.

dist/AcpMcpStdioBridge-BL9bAh79.mjsView on unpkg · L4

dist/claudeHistoryWorker-BvaF6m2o.mjsView file

Findings

2 Critical7 High8 Medium4 Low

CriticalCredential Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs

CriticalReverse Shelldist/claudeHistoryWorker-BvaF6m2o.mjs

HighChild Processdist/AcpMcpStdioBridge-BL9bAh79.mjs

HighShell

HighEvaldist/claudeHistoryWorker-BvaF6m2o.mjs

HighCommand Output Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs

HighCloud Metadata Accessdist/claudeHistoryWorker-BvaF6m2o.mjs

HighObfuscated Payload Loaderdist/claudeHistoryWorker-BvaF6m2o.mjs

HighRemote Agent Bridgedist/claudeHistoryWorker-BvaF6m2o.mjs

MediumSecret Patterndist/runtime-CCVFqL3Y.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @p4code/cli@0.8.13.

See all versions of @p4code/cli for other recorded verdicts.

Review the evidence and your use of @p4code/cli@0.8.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 18:10:12.748Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.