registry / @p4code/cli / 0.8.34
@p4code/cli@0.8.34
⚠ Under reviewP4 Code coding agent server and command-line client
AI Security Review
scanned 21h ago · by lpm-firewall-aiThe flagged function construction is a capability check, and the inspected history worker reads credentials for a local session fork. Source for runtime-loaded @cursor/sdk and playwright-core was absent, so their behavior remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the CLI can reach code that loads the declared runtime dependencies.
Impact
The behavior of these runtime dependencies remains unverified, so a clean verdict is not supported.
Mechanism
The bundle requires @cursor/sdk and can lazily require playwright-core; their implementations could not be inspected in this snapshot.
AI rationale
The flagged function construction is a capability check, and the inspected history worker reads credentials for a local session fork. Source for runtime-loaded @cursor/sdk and playwright-core was absent, so their behavior remains unresolved.
Evidence
package.jsondist/binCli-CvWinVsO.mjs
Decision evidence
public snapshotAI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares @cursor/sdk and playwright-core as runtime dependencies.
- The CLI bundle loads @cursor/sdk and can lazily load playwright-core.
- A session handler invokes the Claude history worker for requested operations.
- The history worker reads Claude credentials and copies them into a local session fork.
- The flagged function construction is an empty-function capability check.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flagged · loading sourcedist/claudeHistoryWorker-C5wI3L-B.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-C5wI3L-B.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-C5wI3L-B.mjsView on unpkg · L11Findings
2 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-C5wI3L-B.mjs
CriticalReverse Shelldist/claudeHistoryWorker-C5wI3L-B.mjs
HighChild Processdist/claudeHistoryWorker-C5wI3L-B.mjs
HighShell
HighEvaldist/claudeHistoryWorker-C5wI3L-B.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-C5wI3L-B.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-C5wI3L-B.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-C5wI3L-B.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-C5wI3L-B.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/resource-monitor/darwin-arm64/p4-resource-monitor
Affected versions and remediation
This report applies to @p4code/cli@0.8.34.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.