registry / @p4code/cli / 0.8.23
@p4code/cli@0.8.23
⚠ Under reviewP4 Code coding agent server and command-line client
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected findings do not substantiate the scanner's credential-exfiltration or reverse-shell claims. A clean decision cannot be supported without broader source coverage, so this requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI or its relevant runtime features.
Impact
No harmful impact was confirmed from the inspected excerpts.
Mechanism
The inspected worker starts a local shell subprocess, and its HTTP server responds to ordinary requests with an error; no harmful command forwarding was established.
AI rationale
The inspected findings do not substantiate the scanner's credential-exfiltration or reverse-shell claims. A clean decision cannot be supported without broader source coverage, so this requires manual review.
Decision evidence
public snapshotAI called this Manual Review at 64.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a CLI entrypoint; no lifecycle hook appears in the inspected metadata.
- The flagged worker code starts a local Bash subprocess with a working directory and piped standard streams.
- The flagged server code returns an HTTP error response to ordinary requests; this excerpt does not show command forwarding.
- The runtime describes importing provider MCP settings into project settings, with provider configuration read for import.
- The inspected client excerpts format settings error messages, but do not establish the behavior of the full application.
Evidence against
- The scanner's shell and socket matches have ordinary CLI subprocess and HTTP server explanations in the inspected excerpts.
- The inspected source does not establish credential transfer to an unrelated recipient or a reverse shell.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
15 flagged · loading sourcedist/runtime-Cui_uQWU.mjsView file
7863patternName = generic_password
severity = medium
line = 7863
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/runtime-Cui_uQWU.mjsView on unpkg · L7863dist/AcpMcpStdioBridge-BuIIHL4p.mjsView file
4import { A as fromIterable, E as fromAsyncIterable, G as mapEffect, Nn as awaitAll, Pn as await_, Pt as unwrap, dt as runForEach, p as empty, st as runCollect } from "./Stream-CdSx...
L5: import * as NodeChildProcess from "node:child_process";
L6: import * as NodeReadline from "node:readline";
High
Child Process
Package source references child process execution.
dist/AcpMcpStdioBridge-BuIIHL4p.mjsView on unpkg · L4dist/claudeHistoryWorker-js6Jgg9C.mjsView file
Findings
3 Critical7 High8 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-js6Jgg9C.mjs
CriticalReverse Shelldist/claudeHistoryWorker-js6Jgg9C.mjs
CriticalPrevious Version Dangerous Deltadist/client/assets/CodexSetupSection.logic-BB9JxUR1.js
HighChild Processdist/AcpMcpStdioBridge-BuIIHL4p.mjs
HighShell
HighEvaldist/claudeHistoryWorker-js6Jgg9C.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-js6Jgg9C.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-js6Jgg9C.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-js6Jgg9C.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-js6Jgg9C.mjs
MediumSecret Pattern
Affected versions and remediation
This report applies to @p4code/cli@0.8.23.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.