Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@qoder-ai/qodercli@1.1.1: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 14 finding(s) warrant review before installing.

View on npm All versions

registry / @qoder-ai/qodercli / 1.1.1

@qoder-ai/qodercli@1.1.1

Qoder AI CLI - AI-powered coding assistant

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 516 KB of source, external domains: angular.io, daily.qoder.ai, daily.qoder.com.cn, download.qoder.com, download.qoder.com.cn, feross.org, github.com, help.aliyun.com, jimmy.warting.se, raw.githubusercontent.com, static.qoder.com.cn, test.qoder.ai, test.qoder.com.cn, www.7-zip.org, www.apache.org

Oversized source lightweight scan

bundle/qoder-worker-runtime.mjs28.8 MB file, sampled 256 KB

FilesystemChildProcess

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

EnvironmentVars

Obfuscated

HighEntropyStrings

Minified

UrlStrings

angular.io

daily.qoder.ai

daily.qoder.com.cn

download.qoder.com

download.qoder.com.cn

feross.org

github.com

help.aliyun.com

jimmy.warting.se

raw.githubusercontent.com

static.qoder.com.cn

test.qoder.ai

test.qoder.com.cn

www.7-zip.org

www.apache.org

bundle/qodercli.js34.2 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsdaily.qoder.aidaily.qoder.com.cndownload.qoder.comdownload.qoder.com.cngithub.comhelp.aliyun.comraw.githubusercontent.comstatic.qoder.com.cntest.qoder.aitest.qoder.com.cnwww.7-zip.org

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/vendor/ripgrep/arm64-darwin/rgView file

•path = bundle/vendor/ripgrep/arm64-darwin/rg kind = native_binary sizeBytes = 4528512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundle/vendor/ripgrep/arm64-darwin/rgView on unpkg

bundle/vendor/qoder-security/bin/qodersec-launch.cmdView file

•path = bundle/vendor/qoder-security/bin/qodersec-launch.cmd kind = build_helper sizeBytes = 5685 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundle/vendor/qoder-security/bin/qodersec-launch.cmdView on unpkg

bundle/qoder-worker-runtime.mjsView file

•path = bundle/qoder-worker-runtime.mjs kind = oversized_source_file sizeBytes = 30178979 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/qoder-worker-runtime.mjsView on unpkg

bundle/qodercli.jsView file

•path = bundle/qodercli.js kind = oversized_cli_entrypoint sizeBytes = 35876544 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/qodercli.jsView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filebundle/qoder-worker-runtime.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binarybundle/vendor/ripgrep/arm64-darwin/rg

MediumShips Build Helperbundle/vendor/qoder-security/bin/qodersec-launch.cmd

MediumOversized Cli Entrypointbundle/qodercli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

AuthorQoder AI

Maintainersyn_cr, qoder-dev

Version1.1.1

PublishedJul 20, 2026

Licensenone

Dependencies1

Integrityverified

Package size25.6 MB

Files41

Keywordsqoderaiclicodingassistantgemini

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → qodercli

Runtimenode >=20.0.0os darwin, linux, win32

Artifact68.1 MB · 41 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemShellHighEntropyStringsMinifiedObfuscatedUrlStringsNoLicense

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 24-47json

24 "linux",

25 "win32"

26 ],

27 "keywords": [

28 "qoder",

29 "ai",

30 "cli",

31 "coding",

32 "assistant",

33 "gemini"

34 ],

35 "homepage": "https://github.com/nicepkg/qodercli",

36 "repository": {

37 "type": "git",

38 "url": "https://github.com/nicepkg/qodercli.git"

39 },

40 "publishConfig": {

41 "access": "public"

42 },

43 "scripts": {

44 "postinstall": "node postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 }

46}

47

bundle/vendor/ripgrep/arm64-darwin/rgView file

•path = bundle/vendor/ripgrep/arm64-darwin/rg kind = native_binary sizeBytes = 4528512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundle/vendor/ripgrep/arm64-darwin/rgView on unpkg

bundle/vendor/qoder-security/bin/qodersec-launch.cmdView file

•path = bundle/vendor/qoder-security/bin/qodersec-launch.cmd kind = build_helper sizeBytes = 5685 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundle/vendor/qoder-security/bin/qodersec-launch.cmdView on unpkg

bundle/qoder-worker-runtime.mjsView file

•path = bundle/qoder-worker-runtime.mjs kind = oversized_source_file sizeBytes = 30178979 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/qoder-worker-runtime.mjsView on unpkg

bundle/qodercli.jsView file

•path = bundle/qodercli.js kind = oversized_cli_entrypoint sizeBytes = 35876544 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/qodercli.jsView on unpkg