registry / @p4code/cli / 0.8.3
@p4code/cli@0.8.3
P4 Code coding agent server and command-line client
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the high-risk worker indicators resolve to session handling and local command execution without inspected socket wiring. The required flagged UI files show message rendering, prompt editing, and user-directed account setup.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the p4c CLI or using the inspected session and UI features.
Impact
No confirmed unauthorized credential disclosure, remote command channel, or agent-configuration mutation was established.
Mechanism
The worker reads or forks a requested Claude session; its flagged configuration location reads environment values for path resolution.
AI rationale
The manifest has no lifecycle hook, and the high-risk worker indicators resolve to session handling and local command execution without inspected socket wiring. The required flagged UI files show message rendering, prompt editing, and user-directed account setup.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the p4c CLI entry point and no lifecycle hook.
- The flagged worker location reads Claude configuration and project-directory environment values to resolve paths.
- The worker requires a session ID and dispatches only to Claude session-message retrieval or session forking.
- ChatMarkdown renders message content through Markdown plugins and components.
- ComposerPromptEditor accepts prompt-editing and change-handler properties.
- The Codex setup UI describes reconnecting and signing in with a user-chosen account.
Evidence against
- The flagged worker’s shell helper runs commands through piped standard input and output; the inspected operation shows no socket wiring.
- The worker operations handle a requested Claude session; inspected source did not establish credential harvesting, unrelated credential transfer, or an attack.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
14 flagged · loading sourcedist/claudeHistoryWorker-v_0uyLGp.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L11Findings
3 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalReverse Shelldist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalPrevious Version Dangerous Deltadist/client/assets/CodexSetupSection.logic-DJw6xB7P.js
HighChild Processdist/claudeHistoryWorker-v_0uyLGp.mjs
HighShell
HighEvaldist/claudeHistoryWorker-v_0uyLGp.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-v_0uyLGp.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-v_0uyLGp.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-v_0uyLGp.mjs
MediumNetwork
Affected versions and remediation
This report applies to @p4code/cli@0.8.3.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.