registry / @p4code/cli / 0.8.16
@p4code/cli@0.8.16
⚠ Under reviewP4 Code coding agent server and command-line client
AI Security Review
scanned 5d ago · by lpm-firewall-aiSource inspection did not verify the scanner’s alleged credential theft, reverse shell, or payload loader. The CLI does launch a bundled executable that could not be analyzed, so manual review is appropriate to resolve its behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the native telemetry client attempts a monitor run.
Impact
The executable’s behavior and effects cannot be determined from the available offline analysis.
Mechanism
The CLI resolves a platform-specific monitor path and spawns that executable as a child process.
AI rationale
Source inspection did not verify the scanner’s alleged credential theft, reverse shell, or payload loader. The CLI does launch a bundled executable that could not be analyzed, so manual review is appropriate to resolve its behavior.
Evidence
dist/binCli-CI34F60b.mjsdist/resource-monitor/darwin-arm64/t3-resource-monitor.lpm-inspection-uOFvqW/0-6a36765d7c61.txt
Decision evidence
public snapshotAI called this Manual Review at 83.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest and CLI entrypoint identify a command-line application without install lifecycle hooks.
- The flagged agent-related locations read Claude project environment values and declare MCP registry identifiers; they do not show a configuration write.
- The worker’s Function reference is a capability check, and its shell code launches a local command subprocess.
- The CLI resolves a bundled resource-monitor executable and spawns it as a child process.
- Offline analysis could not identify or analyze the bundled executable’s behavior.
Evidence against
- The inspected JavaScript does not establish credential exfiltration, a reverse shell, or hidden payload execution; the flagged matches have local runtime uses.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
14 flagged · loading sourcedist/runtime-CEdmfdaF.mjsView file
7859patternName = generic_password
severity = medium
line = 7859
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/runtime-CEdmfdaF.mjsView on unpkg · L7859dist/AcpMcpStdioBridge-BL9bAh79.mjsView file
4import { A as fromIterable, E as fromAsyncIterable, G as mapEffect, Nn as awaitAll, Pn as await_, Pt as unwrap, dt as runForEach, p as empty, st as runCollect } from "./Stream-CX7G...
L5: import * as NodeChildProcess from "node:child_process";
L6: import * as NodeReadline from "node:readline";
High
Child Process
Package source references child process execution.
dist/AcpMcpStdioBridge-BL9bAh79.mjsView on unpkg · L4dist/claudeHistoryWorker-BvaF6m2o.mjsView file
Findings
2 Critical7 High8 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs
CriticalReverse Shelldist/claudeHistoryWorker-BvaF6m2o.mjs
HighChild Processdist/AcpMcpStdioBridge-BL9bAh79.mjs
HighShell
HighEvaldist/claudeHistoryWorker-BvaF6m2o.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-BvaF6m2o.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-BvaF6m2o.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-BvaF6m2o.mjs
MediumSecret Patterndist/runtime-CEdmfdaF.mjs
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @p4code/cli@0.8.16.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.