•matchType = previous_version_dangerous_delta
matchedPackage = @picsart/gen-ai@2.59.3
matchedIdentity = npm:QHBpY3NhcnQvZ2VuLWFp:2.59.3
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli.jsView on unpkg 1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
L2: `)}
1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
L2: `)}
...
L8: `);}function ho(t){process.stderr.write(`${t}
L9: `);}function _D(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=CD;function s(a){zI(process.stdout.isTTY?a:e.strip(a));}return {result(a){zI(a);},info(a){if(r)return;let A=e.blue("...
L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
cli.jsView on unpkg · L1 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
cli.js:
import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri...
`)||t.includes("\r")||t.includes("\0"))===false}function que(t){let e=(t.headersList.get("referrer-policy",true)??"").split(","),r="";if(e.length)for(let i=e.length;i!==0;i--){let ...
`,this[Tde]=a??3e5,this[_de]=i??3e5,this[xde]=y??true,this[s0]=b,this[On]=null,this
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
cli.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
cli.js:
`))}return r}getOrCreate(e){if(e===t)return this;let r=this.store.get(e);if(r)return r;let i=this.tasks.get(e);if(i)return i.waitUntilResolved();i=new Kp;let n=this.providers.get(e...
${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri...
${e.format(r)}`.trim())}};uL.exports=Iv;});var vh=C((IHe,gL)=>{var cL=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:Mpe}=te(),Npe=za();fL()===void 0&&dL(new Npe);fu...
`);}close(){this.#r.close();}get(e){xv(e);let r=this.#A(e);return r?{body:r.body?Buffer.from(r.body.buff
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
cli.jsView on unpkg 1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
L2: `)}
...
L6: `)}
L7: `}let g=[u,d,...f],h=e.maxWidth??kd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var FD=S(()=>{Ut();Vr();});function zI(t){process.stdout.write(`${t}
L8: `);}function ho(t){process.stderr.write(`${t}
L9: `);}function _D(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=CD;function s(a){zI(process.stdout.isTTY?a:e.strip(a));}return {result(a){zI(a);},info(a){if(r)return;let A=e.blue("...
L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
cli.jsView on unpkg · L1 1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js
L1: import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
L2: `)}
...
L6: `)}
L7: `}let g=[u,d,...f],h=e.maxWidth??kd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var FD=S(()=>{Ut();Vr();});function zI(t){process.stdout.write(`${t}
L8: `);}function ho(t){process.stderr.write(`${t}
L9: `);}function _D(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=CD;function s(a){zI(process.stdout.isTTY?a:e.strip(a));}return {result(a){zI(a);},info(a){if(r)return;let A=e.blue("...
L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
cli.jsView on unpkg · L1 13L14: ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri...
L15: `)||t.includes("\r")||t.includes("\0"))===false}function que(t){let e=(t.headersList.get("referrer-policy",true)??"").split(","),r="";if(e.length)for(let i=e.length;i!==0;i--){let ...
MediumDynamic Require
Package source references dynamic require/import behavior.
cli.jsView on unpkg · L13 1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ie from'fs';import Ie__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as ji ...
L2: `)}
...
L6: `)}
L7: `}let g=[u,d,...f],h=e.maxWidth??kd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var FD=S(()=>{Ut();Vr();});function zI(t){process.stdout.write(`${t}
L8: `);}function ho(t){process.stderr.write(`${t}
L9: `);}function _D(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=CD;function s(a){zI(process.stdout.isTTY?a:e.strip(a));}return {result(a){zI(a);},info(a){if(r)return;let A=e.blue("...
L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`
...
L13:
L14: ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvi
LowWeak Crypto
Package source references weak cryptographic algorithms.
cli.jsView on unpkg · L1