@puddle-code/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

5 flagged

dist/public/assets/index-D994oCvG.jsView file

Lines 1-10javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/Terminal-CD3LbItq.js","assets/rolldown-runtime-QTnfLwEv.js","assets/react-CZI7_Jkm.js","assets/jsx-runtime-ffCh33zF.js","assets/api-BJKPJeFZ.js","assets/utils-B6KiDbIe.js","assets/ssh-mode-DWHs6m9n.js","assets/Terminal-BrP-ENHg.css","assets/SettingsDialog-aRqM2FKI.js","assets/dialog-B43iKmfK.js","assets/createLucideIcon-DyMAgLa3.js","assets/switch-BbnQDPjG.js","assets/dist-fdPAlKke.js","assets/Dashboard-C1H7r1Al.js","assets/context-menu-CGL06LiB.js","assets/Workspace-ChM_ssfz.js","assets/useMutation-Da9b4jwS.js","assets/editor-ta ...

2import{r as e,t}from"./rolldown-runtime-QTnfLwEv.js";import{t as n}from"./react-CZI7_Jkm.js";import{n as r,t as i}from"./jsx-runtime-ffCh33zF.js";import{C as a,S as o,_ as s,a as

3 at`)?` (<anonymous>)`:-1<e.stack.indexOf(`@`)?`@unknown:0:0`:``}return`

4`+be+e+xe}var Ce=!1;function we(e,t){if(!e||Ce)return``;Ce=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{var r={DetermineComponentFrameRoot:function(){try{if(t){var n=function(){throw

5`),l=s.split(`

6`);for(i=r=0;r<c.length&&!c[r].includes(`DetermineComponentFrameRoot`);)r++;for(;i<l.length&&!l[i].includes(`DetermineComponentFrameRoot`);)i++;if(r===c.length||i===l.length)for(r=c.length-1,i=l.length-1;1<=r&&0<=i&&c[r]!==l[i];)i--;for(;1<=r&&0<=i;r--,i--)if(c[r]!==l[i]){if(r!==1||i!==1)do if(r--,i--,0>i||c[r]!==l[i]){var u=`

7`+c[r].replace(` at new `,` at `);return e.displayName&&u.includes(`<anonymous>`)&&(u=u.replace(`<anonymous>`,e.displayName)),u}while(1<=r&&0<=i);break}}}finally{Ce=!1,Error.prepareStackTrace=n}return(n=e?e.displayName||e.name:``)?Se(n):``}function Te(e,t){switch(e.tag){case 26:case 27:case 5:return Se(e.type);case 16:return Se(`Lazy`);case 13:return e.child!==t&&t!==null?Se(`Suspense Fallback`):Se(`Suspense`);case 19:return Se(`SuspenseList`);case 0:case 15:return we(e.type,!1);case 11:return we(e.type.render,!1);case 1:return we(e.type,!0);case 31:return Se(`Activity`);default:return``}}func ...

8Error generating stack: `+e.message+`

9`+e.stack}}var De=Object.prototype.hasOwnProperty,Oe=t.unstable_scheduleCallback,ke=t.unstable_cancelCallback,Ae=t.unstable_shouldYield,je=t.unstable_requestPaint,Me=t.unstable_now,Pe=t.unstable_getCurrentPriorityLevel,Fe=t.unstable_ImmediatePriority,Ie=t.unstable_UserBlockingPriority,Le=t.unstable_NormalPriority,Re=t.unstable_LowPriority,ze=t.unstable_IdlePriority,Be=t.log,Ve=

10`).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,i,a){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Zt(e,r):(typeof r==`number`||typeof r==`bigint`)&&t!==`body`&&Zt(e,``+r);break;case`className`:Ft(e,`class`,r);break;case`tabIndex`:Ft(e,`tabindex`,r);break;case`dir`:case`role`:case`viewBox`:case`width`:case`height`:Ft(e,n,r);break;case`

Long lines were clipped for display.

dist/public/assets/html.worker-DSJ9zmd7.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/html.worker-DSJ9zmd7.jsView on unpkg · L29

dist/install.shView file

•path = dist/install.sh kind = build_helper sizeBytes = 9536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/install.shView on unpkg

dist/public/assets/UbuntuSans-Italic-variable-RySnp6Km.woff2View file

•path = dist/public/assets/UbuntuSans-Italic-variable-RySnp6Km.woff2 kind = high_entropy_blob sizeBytes = 254816 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/UbuntuSans-Italic-variable-RySnp6Km.woff2View on unpkg

dist/public/assets/ts.worker-BtjBFNHX.jsView file

•path = dist/public/assets/ts.worker-BtjBFNHX.js kind = oversized_source_file sizeBytes = 6895078 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/ts.worker-BtjBFNHX.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/public/assets/index-D994oCvG.jsView file

9`+e.stack}}var De=Object.prototype.hasOwnProperty,Oe=t.unstable_scheduleCallback,ke=t.unstable_cancelCallback,Ae=t.unstable_shouldYield,je=t.unstable_requestPaint,Me=t.unstable_now... L10: `).replace(Ad,``)}function Md(e,t){return t=jd(t),jd(e)===t}function $(e,t,n,r,i,a){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||Zt(e,r):(typeof ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/public/assets/index-D994oCvG.jsView on unpkg · L9

dist/public/assets/html.worker-DSJ9zmd7.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/html.worker-DSJ9zmd7.jsView on unpkg · L29

@puddle-code/cli: Suspicious npm security report (Warn) | LPM Firewall

@puddle-code/cli@0.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code