43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L1204: var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process10.stdout.write(str),
L1256: writeErr: (str) => process10.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.cjsView on unpkg · L43 43Trigger-reachable chain: manifest.bin -> dist/cli.cjs
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L1204: var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process10.stdout.write(str),
L1256: writeErr: (str) => process10.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.cjsView on unpkg · L43 1204var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
83522try {
L83523: const dn = globalThis.__dirname ?? eval("typeof __dirname !== 'undefined' ? __dirname : null");
L83524: if (dn) seeds.add(dn);
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.cjs:
await fh.writeFile(`${process.pid}
var fs$writeFile = fs36.writeFile;
fs36.writeFile = writeFile2;
function writeFile2(path46, data, options, cb) {
return go$writeFile(path46, data, options, cb);
function go$writeFile(path47, data2, options2, cb2, startTime) {
return fs$writeFile(path47, data2, options2, function(err) {
enqueue([go$writeFile, [path47, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.cjsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli.cjs:
// node_modules/commander/lib/error.js
"node_modules/commander/lib/error.js"(exports2) {
// node_modules/commander/lib/argument.js
"node_modules/commander/lib/argument.js"(exports2) {
// node_modules/commander/lib/help.js
"node_modules/commander/lib/help.js"(exports2) {
* Detect manually wrapped and indented strings by checking for line break followed by whitespace.
* Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli.cjsView on unpkg 8995if (!fs35[gracefulQueue]) {
L8996: queue2 = global[gracefulQueue] || [];
L8997: publishQueue(fs35, queue2);
HighObfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/cli.cjsView on unpkg · L8995 43Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.cjs
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L1204: var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process10.stdout.write(str),
L1256: writeErr: (str) => process10.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/cli.cjsView on unpkg · L43 •Trigger-reachable fixed external POST callback chain: manifest.bin -> dist/cli.cjs
`choices: ${option.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`
`default: ${option.defaultValueDescription || JSON.stringify(option.defaultValue)}`
extraInfo.push(`preset: ${JSON.stringify(option.presetArg)}`);
`choices: ${argument.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`
`default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}`
writeOut: (str) => process10.stdout.write(str),
writeErr: (str) => process10.stderr.write(str),
outputError: (str, write) => write(str),
HighTrigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
dist/cli.cjsView on unpkg 65989log2(import_picocolors6.default.dim("Running Expo prebuild..."));
L65990: const prebuild = await execa("npx", ["expo", "prebuild"], { cwd: stagingPath, stdio: params.json ? "ignore" : "inherit" });
L65991: if (prebuild.exitCode !== 0) {
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/cli.cjsView on unpkg · L65989 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli.cjsView on unpkg 11};
L12: var __commonJS = (cb, mod) => function __require() {
L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
MediumDynamic Require
Package source references dynamic require/import behavior.
dist/cli.cjsView on unpkg · L11