Loading npm security reports…

@sctg/cline-chatbot@4.0.0-beta.20260705130748: Suspicious npm | LPM Firewall

registry / @sctg/cline-chatbot / 4.0.0-beta.20260705130748

@sctg/cline-chatbot@4.0.0-beta.20260705130748

Reusable KeypoolLive chatbot React component (<Chatbot />) built on @sctg/cline-agents, @sctg/cline-llms and @sctg/cline-shared

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 193 file(s), 19.7 MB of source, external domains: 169.254.169.254, accounts.google.com, ai-gateway.vercel.sh, ai-sdk.dev, ai.google.dev, aiplatform.googleapis.com, api.aihubmix.com, api.anthropic.com, api.asksage.ai, api.cerebras.ai, api.cline.bot, api.cohere.com, api.deepseek.com, api.dify.ai, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.groq.com, api.hicap.ai, api.inference.wandb.ai, api.kilo.ai, api.minimax.io, api.mistral.ai, api.moonshot.ai, api.openai.com, api.sambanova.ai, api.studio.nebius.ai, api.together.xyz, api.v0.dev, api.x.ai, api.xiaomimimo.com, api.z.ai, app.cline.bot, ark.cn-beijing.volces.com, aws.amazon.com, bedrock-agent-runtime.us-west-2.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, chatgpt.com, chevrotain.io, cloud.google.com, cloud.langfuse.com, cloudresourcemanager.googleapis.com, code.aiservice.us-chicago-1.oci.oraclecloud.com, code.claude.com, core-api.staging.int.cline.bot, dashscope.aliyuncs.com, developer.mozilla.org, docs.anthropic.com

Source & flagged code

13 flagged · loading source

dist-lib/pyodide/pyodide.mjsView file

2`).filter(function(r){return!!r.match(e)},this);return s.map(function(r){r.indexOf("(eval ")>-1&&(r=r.replace(/eval code/g,"eval").replace(/(\(eval at [^()]*)|(,.*$)/g,""));var a=r... L3: `).filter(function(r){return!r.match(t)},this);return s.map(function(r){if(r.indexOf(" > eval")>-1&&(r=r.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,":$1")),r.indexO... L4: //# sourceMappingURL=pyodide.mjs.map

High

Child Process

Package source references child process execution.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

2`).filter(function(r){return!!r.match(e)},this);return s.map(function(r){r.indexOf("(eval ")>-1&&(r=r.replace(/eval code/g,"eval").replace(/(\(eval at [^()]*)|(,.*$)/g,""));var a=r... L3: `).filter(function(r){return!r.match(t)},this);return s.map(function(r){if(r.indexOf(" > eval")>-1&&(r=r.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,":$1")),r.indexO... L4: //# sourceMappingURL=pyodide.mjs.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

dist-lib/pyodide/pyodide.asm.mjsView file

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

dist-lib/assets/vertex-odMNmnPo.jsView file

4import { d as [redacted], p as UnsupportedFunctionalityError, t as AISDKError, u as NoSuchModelError } from "./dist-CUKIbuXC.js"; L5: import { I as lazySchema, J as resolve, K as postJsonToApi, R as loadOptionalSetting, T as generateId, V as normalizeHeaders, W as parseProviderOptions, _ as createProviderToolFact... L6: import { t as require___vite_browser_external } from "./__vite-browser-external-CxIJdHGg.js"; ... L83: //#endregion L84: //#region ../../node_modules/.bun/gaxios@7.1.5+2b91fc17bf64bdfd/node_modules/gaxios/package.json L85: var package_exports$1 = /* @__PURE__ */ __exportAll({ ... L401: if (!obj || typeof obj !== "object") return; L402: else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) obj.forEach((_, key) => { L403:

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist-lib/assets/vertex-odMNmnPo.jsView on unpkg · L4

4Cross-file remote execution chain: dist-lib/assets/vertex-odMNmnPo.js spawns dist-lib/assets/rolldown-runtime-BzI350Cx.js; helper contains network access plus dynamic code execution. L4: import { d as [redacted], p as UnsupportedFunctionalityError, t as AISDKError, u as NoSuchModelError } from "./dist-CUKIbuXC.js"; L5: import { I as lazySchema, J as resolve, K as postJsonToApi, R as loadOptionalSetting, T as generateId, V as normalizeHeaders, W as parseProviderOptions, _ as createProviderToolFact... L6: import { t as require___vite_browser_external } from "./__vite-browser-external-CxIJdHGg.js"; ... L83: //#endregion L84: //#region ../../node_modules/.bun/gaxios@7.1.5+2b91fc17bf64bdfd/node_modules/gaxios/package.json L85: var package_exports$1 = /* @__PURE__ */ __exportAll({ ... L401: if (

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-lib/assets/community-M781ImaO.jsView file

18489return async () => { L18490: Gu(e.baseURL); L18491: let t = await e.identityTokenProvider(); ... L22801: }, L22802: readFileSync(e, t) { L22803: let o = [];

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist-lib/assets/community-M781ImaO.jsView on unpkg · L18489

dist-lib/pyodide/pyodide.asm.wasmView file

•path = dist-lib/pyodide/pyodide.asm.wasm kind = wasm_module sizeBytes = 9609998 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-lib/pyodide/pyodide.asm.wasmView on unpkg

dist-lib/pyodide/python_stdlib.zipView file

•path = dist-lib/pyodide/python_stdlib.zip kind = high_entropy_blob sizeBytes = 2552456 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = compressed_blob sizeBytes = 2552456 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = nested_archive_needs_inspection sizeBytes = 2552456 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-lib/pyodide/python_stdlib.zipView on unpkg

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2329582 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg

Source & flagged code

13 flagged

dist-lib/pyodide/pyodide.mjsView file

Lines 1-5javascript

1var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0}),R=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var W=(()=>{for(var e=new Uint8Array(128),t=0;t<64;t++)e[t<26?t+65:t<52?t+71:t<62?t-4:t*4-205]=t;return n=>{for(var i=n.length,s=new Uint8Array((i-(n[i-1]=="=")-(n[i-2]=="="))*3/4|0),r=0,a=0;r<i;){var c=e[n.charCodeAt(r++)],l=e[n.charCodeAt(r++)],d=e[n.charCodeAt(r++)],u=e[n. ...

2`).filter(function(r){return!!r.match(e)},this);return s.map(function(r){r.indexOf("(eval ")>-1&&(r=r.replace(/eval code/g,"eval").replace(/(\(eval at [^()]*)|(,.*$)/g,""));var a=r.replace(/^\s+/,"").replace(/\(eval code/g,"(").replace(/^.*?\s+/,""),c=a.match(/ (\(.+\)$)/);a=c?a.replace(c[0],""):a;var l=this.extractLocation(c?c[1]:a),d=c&&a||void 0,u=["eval","<anonymous>"].indexOf(l[0])>-1?void 0:l[0];return new A({functionName:d,fileName:u,lineNumber:l[1],columnNumber:l[2],source:r})},this)},"ErrorStackParser$$parseV8OrIE"),parseFFOrSafari:o(function(i){var s=i.stack.split(`

3`).filter(function(r){return!r.match(t)},this);return s.map(function(r){if(r.indexOf(" > eval")>-1&&(r=r.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,":$1")),r.indexOf("@")===-1&&r.indexOf(":")===-1)return new A({functionName:r});var a=/((.*".+"[^@]*)?[^@]*)(?:@)/,c=r.match(a),l=c&&c[1]?c[1]:void 0,d=this.extractLocation(r.replace(a,""));return new A({functionName:l,fileName:d[0],lineNumber:d[1],columnNumber:d[2],source:r})},this)},"ErrorStackParser$$parseFFOrSafari")}}o(ne,"ErrorStackParser");var re=new ne;var M=re;function ie(){if(typeof API<"u"&&API!==globalThis.API)return API ...

4//# sourceMappingURL=pyodide.mjs.map

High

Child Process

Package source references child process execution.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

5

Long lines were clipped for display.

dist-lib/pyodide/pyodide.asm.mjsView file

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

dist-lib/assets/vertex-odMNmnPo.jsView file

Lines 1-24javascript

1import { n as __esmMin, o as __toCommonJS, r as __exportAll, s as __toESM, t as __commonJSMin } from "./rolldown-runtime-BzI350Cx.js";

2import { At as boolean, Et as array, Nn as record, Rn as string, Tn

dist-lib/assets/community-M781ImaO.jsView file

18489return async () => { L18490: Gu(e.baseURL); L18491: let t = await e.identityTokenProvider(); ... L22801: }, L22802: readFileSync(e, t) { L22803: let o = [];

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist-lib/assets/community-M781ImaO.jsView on unpkg · L18489

dist-lib/pyodide/pyodide.asm.wasmView file

•path = dist-lib/pyodide/pyodide.asm.wasm kind = wasm_module sizeBytes = 9609998 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-lib/pyodide/pyodide.asm.wasmView on unpkg

dist-lib/pyodide/python_stdlib.zipView file

•path = dist-lib/pyodide/python_stdlib.zip kind = high_entropy_blob sizeBytes = 2552456 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = compressed_blob sizeBytes = 2552456 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = nested_archive_needs_inspection sizeBytes = 2552456 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-lib/pyodide/python_stdlib.zipView on unpkg

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2329582 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg