registry / @p4code/cli / 0.8.8
@p4code/cli@0.8.8
⚠ Under reviewP4 Code coding agent server and command-line client
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected high-risk matches resolve to ordinary library behavior, and the manifest shows no lifecycle scripts or runtime self-dependency. A clean verdict requires 196 distinct citations, exceeding the 128-citation limit, so manual review is required without treating scanner hints as proof of risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The inspected runtime paths activate through CLI invocation or settings interaction.
Impact
No attack impact is established by these excerpts; the remaining source coverage is unresolved.
Mechanism
The reviewed worker handles session history operations; the inspected dynamic-code and socket matches are capability-check and HTTP server code.
AI rationale
The inspected high-risk matches resolve to ordinary library behavior, and the manifest shows no lifecycle scripts or runtime self-dependency. A clean verdict requires 196 distinct citations, exceeding the 128-citation limit, so manual review is required without treating scanner hints as proof of risk.
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares the p4c CLI entry and shows no lifecycle scripts or dependency on itself.
- The history worker dispatches requests to session message retrieval or session forking.
- The dynamic Function match is an empty-function capability check; the WebSocket match creates an HTTP server that returns status 426.
- The requested runtime-operation byte windows contain settings-save error display formatting.
Evidence against
- Inspected flagged matches do not establish credential transfer, a reverse shell, or install-time mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
14 flagged · loading sourcedist/AcpMcpStdioBridge-WH45ZIFK.mjsView file
3import { $ as forEach$1, $c as exitFail, $r as makeUnsafe$2, $t as runPromise, Ac as some, Ai as interrupt$2, As as isArray, B as filter$3, Ba as fiberAwaitAll, Bo as isFinite, Bs ...
L4: import * as NodeChildProcess from "node:child_process";
L5: import * as NodeReadline from "node:readline";
High
Child Process
Package source references child process execution.
dist/AcpMcpStdioBridge-WH45ZIFK.mjsView on unpkg · L3dist/claudeHistoryWorker-C1bTkcUr.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-C1bTkcUr.mjsFindings
3 Critical7 High7 Medium4 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-C1bTkcUr.mjs
CriticalReverse Shelldist/claudeHistoryWorker-C1bTkcUr.mjs
CriticalPrevious Version Dangerous Deltadist/client/assets/CodexSetupSection.logic-DobP-gmw.js
HighChild Processdist/AcpMcpStdioBridge-WH45ZIFK.mjs
HighShell
HighEvaldist/claudeHistoryWorker-C1bTkcUr.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-C1bTkcUr.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-C1bTkcUr.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-C1bTkcUr.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-C1bTkcUr.mjs
MediumNetwork
Affected versions and remediation
This report applies to @p4code/cli@0.8.8.
See all versions of @p4code/cli for other recorded verdicts.
- Review the evidence and your use of @p4code/cli@0.8.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.