142for (const host of ["registry.npmjs.org", "github.com"]) {
L143: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
L144: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
...
L149: "--connect-timeout", "10",
L150: "https://registry.npmjs.org/",
L151: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
...
L156: function captureNpmDebugLog() {
L157: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
L158: if (!existsSync(logsDir))
CriticalSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L142 1#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
CriticalDownload Execute
Source downloads or fetches remote code and executes it.
dist/index.jsView on unpkg · L1 1Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERS
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L1 1#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L1 537// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L538: // composition runs through bash -c so the curl|gpg pipeline is one
L539: // privileged command rather than two separate sudo escalations.
1#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L1 1Trigger-reachable persistence chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L1 285function canSudo() {
L286: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L287: return result.status === 0;
...
L289: /** True when the npm global prefix's node_modules dir is writable by the current
L290: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L291: function npm[redacted]() {
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L285 1#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1