registry / @p4code/cli / 0.8.18
@p4code/cli@0.8.18
P4 Code coding agent server and command-line client
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and inspected CLI and worker code ties the flagged behavior to session operations. The scanner’s dynamic-code and socket indicators resolve to a capability probe and WebSocket handling; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the CLI or requests a Claude session history operation.
Impact
No confirmed malicious effect or unauthorized credential transfer was established.
Mechanism
The worker retrieves or forks session data and returns a JSON result; the inspected configuration helper compares paths and validates a project directory name.
AI rationale
The manifest has no install lifecycle hooks, and inspected CLI and worker code ties the flagged behavior to session operations. The scanner’s dynamic-code and socket indicators resolve to a capability probe and WebSocket handling; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 80.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI binary and has no lifecycle script entries.
- The worker is called by a hidden CLI command and accepts only session-message retrieval or session forking with a required session ID.
- The reported Claude configuration location compares paths and validates a project directory name; it does not write agent configuration.
- The dynamic Function occurrence is an empty-function capability probe that catches failure.
- The socket server returns HTTP 426 to non-upgrade requests, consistent with a WebSocket server rather than reverse-shell wiring.
- The flagged frontend and library files contain UI assets and bundled Effect/Schema code; inspected indicators do not establish an attack.
Evidence against
- The bundle includes dynamic function construction and a WebSocket server, but the inspected code shows a capability check and HTTP upgrade handling, not hidden payload execution or a reverse shell.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEval
Source & flagged code
13 flagged · loading sourcedist/AcpMcpStdioBridge-BL9bAh79.mjsView file
4import { A as fromIterable, E as fromAsyncIterable, G as mapEffect, Nn as awaitAll, Pn as await_, Pt as unwrap, dt as runForEach, p as empty, st as runCollect } from "./Stream-CX7G...
L5: import * as NodeChildProcess from "node:child_process";
L6: import * as NodeReadline from "node:readline";
High
Child Process
Package source references child process execution.
dist/AcpMcpStdioBridge-BL9bAh79.mjsView on unpkg · L4dist/claudeHistoryWorker-BvaF6m2o.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-BvaF6m2o.mjsFindings
2 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs
CriticalReverse Shelldist/claudeHistoryWorker-BvaF6m2o.mjs
HighChild Processdist/AcpMcpStdioBridge-BL9bAh79.mjs
HighShell
HighEvaldist/claudeHistoryWorker-BvaF6m2o.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-BvaF6m2o.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-BvaF6m2o.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-BvaF6m2o.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-BvaF6m2o.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/resource-monitor/darwin-arm64/t3-resource-monitor
Affected versions and remediation
This report applies to @p4code/cli@0.8.18.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.