@priders/cwindsurf: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@priders/cwindsurf: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "const m=Number(process.versions.node.split('.')[0]);if(!Number.isInteger(m)||m<18){console.error('\n安装 @priders/cwindsurf 需要 Node.js 18 或更高版本，当前版本：'+process.version+'。\n请升...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const m=Number(process.versions.node.split('.')[0]);if(!Number.isInteger(m)||m<18){console.error('\n安装 @priders/cwindsurf 需要 Node.js 18 或更高版本，当前版本：'+process.version+'。\n请升...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli.jsView file

1#!/usr/bin/env node L2: (function(_0x206ab3,_0x611b7c){const _0x463441=_0x206ab3();function _0x265d64(_0x36485c,_0x375988,_0x35d478,_0x492c5f){return _0x2947(_0x36485c- -0x2f9,_0x35d478);}while(!![]){try{... L3: function _0x2ab8(_0x591739,_0x3a9a50){_0x591739=_0x591739-(0x15c1+0x1e3+-0x16df);var _0x17540f=_0xdeb8();var _0x23047f=_0x17540f[_0x591739];if(_0x2ab8['LhonmH']===undefined){var _0...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

vsix/windsurf2plus-0.2.0.vsixView file

•path = vsix/windsurf2plus-0.2.0.vsix kind = high_entropy_blob sizeBytes = 4089120 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/windsurf2plus-0.2.0.vsixView on unpkg

•path = vsix/windsurf2plus-0.2.0.vsix kind = compressed_blob sizeBytes = 4089120 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/windsurf2plus-0.2.0.vsixView on unpkg

•path = vsix/windsurf2plus-0.2.0.vsix kind = nested_archive_needs_inspection sizeBytes = 4089120 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/windsurf2plus-0.2.0.vsixView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 13-36json

13 "gemini"

14 ],

15 "type": "module",

16 "bin": {

17 "cwindsurf": "./dist/cli.js"

18 },

19 "files": [

20 "dist/",

21 "vsix/",

22 "THIRD_PARTY_NOTICES.txt"

23 ],

24 "license": "UNLICENSED",

25 "private": false,

26 "publishConfig": {

27 "access": "public"

28 },

29 "engines": {

30 "node": ">=18"

31 },

32 "scripts": {

33 "preinstall": "node -e \"const m=Number(process.versions.node.split('.')[0]);if(!Number.isInteger(m)||m<18){console.error('\\n安装 @priders/cwindsurf 需要 Node.js 18 或更高版本，当前版本：'+process.version+'。\\n请升级 Node.js 后重试。\\n');process.exit(1)}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L33

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 }

35}

36

dist/cli.jsView file

1#!/usr/bin/env node L2: (function(_0x206ab3,_0x611b7c){const _0x463441=_0x206ab3();function _0x265d64(_0x36485c,_0x375988,_0x35d478,_0x492c5f){return _0x2947(_0x36485c- -0x2f9,_0x35d478);}while(!![]){try{... L3: function _0x2ab8(_0x591739,_0x3a9a50){_0x591739=_0x591739-(0x15c1+0x1e3+-0x16df);var _0x17540f=_0xdeb8();var _0x23047f=_0x17540f[_0x591739];if(_0x2ab8['LhonmH']===undefined){var _0...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

vsix/windsurf2plus-0.2.0.vsixView file

•path = vsix/windsurf2plus-0.2.0.vsix kind = high_entropy_blob sizeBytes = 4089120 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/windsurf2plus-0.2.0.vsixView on unpkg

•path = vsix/windsurf2plus-0.2.0.vsix kind = compressed_blob sizeBytes = 4089120 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/windsurf2plus-0.2.0.vsixView on unpkg

•path = vsix/windsurf2plus-0.2.0.vsix kind = nested_archive_needs_inspection sizeBytes = 4089120 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/windsurf2plus-0.2.0.vsixView on unpkg