registry / @p4code/cli / 0.8.31
@p4code/cli@0.8.31
⚠ Under reviewP4 Code coding agent server and command-line client
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected worker excerpts support Claude history functionality, and the flagged credential code does not show an unrelated recipient. The declared @cursor/sdk dependency remains unresolved and broader source coverage is incomplete, so the available evidence does not support either a clean verdict or a confirmed attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Use of the CLI may load its runtime dependencies.
Impact
The unresolved dependency behavior prevents a clean determination; no credential theft or reverse shell was confirmed in the inspected excerpts.
Mechanism
The manifest declares @cursor/sdk, whose source was unavailable for inspection; the visible worker code delegates Claude session operations to history or session-store functions.
AI rationale
The inspected worker excerpts support Claude history functionality, and the flagged credential code does not show an unrelated recipient. The declared @cursor/sdk dependency remains unresolved and broader source coverage is incomplete, so the available evidence does not support either a clean verdict or a confirmed attack.
Evidence
package.jsondist/binCli-CJxvJzbR.mjsdist/claudeHistoryWorker-js6Jgg9C.mjs
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @cursor/sdk as a runtime dependency, but its source could not be resolved in this review.
- The flagged worker is imported by the CLI and its session functions delegate to session-store or history operations.
- The worker reads Anthropic credentials for its API client; this excerpt does not establish transfer to an unrelated recipient.
Evidence against
- The worker’s visible exports and session functions are consistent with Claude history retrieval and forking.
- The inspected credential excerpt shows credentials configured for the Anthropic API client; no unrelated destination is established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
14 flagged · loading sourcedist/AcpMcpStdioBridge-BuIIHL4p.mjsView file
4import { A as fromIterable, E as fromAsyncIterable, G as mapEffect, Nn as awaitAll, Pn as await_, Pt as unwrap, dt as runForEach, p as empty, st as runCollect } from "./Stream-CdSx...
L5: import * as NodeChildProcess from "node:child_process";
L6: import * as NodeReadline from "node:readline";
High
Child Process
Package source references child process execution.
dist/AcpMcpStdioBridge-BuIIHL4p.mjsView on unpkg · L4dist/claudeHistoryWorker-js6Jgg9C.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-js6Jgg9C.mjsFindings
3 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-js6Jgg9C.mjs
CriticalReverse Shelldist/claudeHistoryWorker-js6Jgg9C.mjs
CriticalPrevious Version Dangerous Deltadist/client/assets/CodexSetupSection.logic-D6jywL3c.js
HighChild Processdist/AcpMcpStdioBridge-BuIIHL4p.mjs
HighShell
HighEvaldist/claudeHistoryWorker-js6Jgg9C.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-js6Jgg9C.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-js6Jgg9C.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-js6Jgg9C.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-js6Jgg9C.mjs
MediumNetwork
Affected versions and remediation
This report applies to @p4code/cli@0.8.31.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.