registry / @p4code/cli / 0.8.5
@p4code/cli@0.8.5
P4 Code coding agent server and command-line client
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found no lifecycle hook or concrete malicious behavior supporting the scanner verdict. The flagged worker, runtime check, markdown rendering, file preview, and setup flow align with the package's CLI and application features.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the p4c command or activates an application feature.
Impact
No credential theft, persistence, destructive behavior, or unconsented agent configuration change was established.
Mechanism
The inspected worker handles fixed Claude history operations, while the flagged eval code checks runtime support and the markdown renderer sanitizes SVG output.
AI rationale
Source inspection found no lifecycle hook or concrete malicious behavior supporting the scanner verdict. The flagged worker, runtime check, markdown rendering, file preview, and setup flow align with the package's CLI and application features.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entrypoint and lists no install lifecycle hooks.
- The CLI entrypoint dispatches commands only when run as the process entrypoint.
- The indicated Claude config helper resolves a config directory and compares paths; it does not modify agent configuration there.
- The Claude history worker requires a session ID, selects from fixed history operations, and returns results to stdout.
- The markdown renderer sanitizes generated SVG and blocks script tags and URL-bearing attributes.
- The composer preview fetches the requested file with abort and range handling.
- The Codex setup flow changes to managed mode from a user-triggered Continue button.
Evidence against
- The eval match is a guarded runtime capability check, not execution of a supplied payload.
- Inspected worker excerpts did not establish credential transfer or reverse-shell wiring; the labels alone do not prove those behaviors.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEval
Source & flagged code
14 flagged · loading sourcedist/claudeHistoryWorker-v_0uyLGp.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-v_0uyLGp.mjsView on unpkg · L11Findings
3 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalReverse Shelldist/claudeHistoryWorker-v_0uyLGp.mjs
CriticalPrevious Version Dangerous Deltadist/client/assets/CodexSetupSection.logic-YSEDjbLd.js
HighChild Processdist/claudeHistoryWorker-v_0uyLGp.mjs
HighShell
HighEvaldist/claudeHistoryWorker-v_0uyLGp.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-v_0uyLGp.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-v_0uyLGp.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-v_0uyLGp.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-v_0uyLGp.mjs
MediumNetwork
Affected versions and remediation
This report applies to @p4code/cli@0.8.5.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.