@sctg/cline-chatbot@4.0.0-beta.20260709152514: Clean npm security | LPM Firewall

Loading npm security reports…

@sctg/cline-chatbot@4.0.0-beta.20260709152514: Clean npm security | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts; exports only dist-lib/index.js and vite-plugin.
dist-lib/index.js exports a React Chatbot component; import side effects are bundled library initialization, not project mutation.
GitHub OAuth/device-flow code is user-invoked and stores only returned GitHub token in localStorage key chatbot_github_token.
Vault/usage fetches go to caller-provided vaultUrl/usageDbUrl and package-aligned /v1/keypool paths with bearer token.
dist-lib/assets/pyodide-CtZbGtxv.js and dist-lib/pyodide/* are bundled Pyodide wasm/stdlib assets, not a staged downloader.
dist-lib/vitePlugin/index.js only copies this package's dist-lib/assets into the build outDir during Vite closeBundle.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 204 file(s), 19.9 MB of source, external domains: 169.254.169.254, accounts.google.com, ai-gateway.vercel.sh, ai-sdk.dev, ai.google.dev, aiplatform.googleapis.com, api.aihubmix.com, api.anthropic.com, api.asksage.ai, api.cerebras.ai, api.cline.bot, api.cohere.com, api.deepseek.com, api.dify.ai, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.groq.com, api.hicap.ai, api.inference.wandb.ai, api.kilo.ai, api.minimax.io, api.mistral.ai, api.moonshot.ai, api.openai.com, api.sambanova.ai, api.studio.nebius.ai, api.together.xyz, api.v0.dev, api.x.ai, api.xiaomimimo.com, api.z.ai, app.cline.bot, ark.cn-beijing.volces.com, aws.amazon.com, bedrock-agent-runtime.us-west-2.amazonaws.com, bedrock-runtime.us-east-1.amazonaws.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, chatgpt.com, chevrotain.io, cloud.google.com, cloud.langfuse.com, cloud.tencent.com, cloudresourcemanager.googleapis.com, code.aiservice.us-chicago-1.oci.oraclecloud.com, code.claude.com, core-api.staging.int.cline.bot, dashscope.aliyuncs.com, developer.mozilla.org

Oversized source lightweight scan

dist-lib/assets/internal-CJaRLlPx.js2.04 MB file, sampled 256 KB

DynamicRequireHighEntropyStrings

dist-lib/assets/typescript-yGPqb3Kt.js7.47 MB file, sampled 256 KB

Filesystem

dist-lib/assets/worker-tools-CBbEKygT.js2.12 MB file, sampled 256 KB

NetworkChildProcessEvalHighEntropyStringsUrlStringsapi.github.comgithub.commy.meteoblue.comwww.w3.org

dist-lib/index.js2.22 MB file, sampled 256 KB

FilesystemNetworkEvalHighEntropyStringsUrlStringsapi.firecrawl.devgithub.com

Source & flagged code

13 flagged · loading source

dist-lib/pyodide/pyodide.mjsView file

2`).filter(function(r){return!!r.match(e)},this);return s.map(function(r){r.indexOf("(eval ")>-1&&(r=r.replace(/eval code/g,"eval").replace(/(\(eval at [^()]*)|(,.*$)/g,""));var a=r... L3: `).filter(function(r){return!r.match(t)},this);return s.map(function(r){if(r.indexOf(" > eval")>-1&&(r=r.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,":$1")),r.indexO... L4: //# sourceMappingURL=pyodide.mjs.map

High

Child Process

Package source references child process execution.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

2`).filter(function(r){return!!r.match(e)},this);return s.map(function(r){r.indexOf("(eval ")>-1&&(r=r.replace(/eval code/g,"eval").replace(/(\(eval at [^()]*)|(,.*$)/g,""));var a=r... L3: `).filter(function(r){return!r.match(t)},this);return s.map(function(r){if(r.indexOf(" > eval")>-1&&(r=r.replace(/ line (\d+)(?: > eval line \d+)* > eval:\d+:\d+/g,":$1")),r.indexO... L4: //# sourceMappingURL=pyodide.mjs.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-lib/pyodide/pyodide.mjsView on unpkg · L2

dist-lib/pyodide/pyodide.asm.mjsView file

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

1async function _createPyodideModule(moduleArg={}){var moduleRtn;var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalS... L2: ;return moduleRtn}export default _createPyodideModule;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-lib/pyodide/pyodide.asm.mjsView on unpkg · L1

dist-lib/assets/dist-es-0JACG7BN.jsView file

56}); L57: req.end(); L58: }); ... L75: const requestOptions = await getCmdsUri({ logger: init.logger }); L76: const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions)); L77: if (!isImdsCredentials(credsResponse)) throw new CredentialsProviderError("Invalid response received from instance metadata service.", { logger: init.logger }); ... L143: (function(Endpoint) { L144: Endpoint["IPv4"] = "http://169.254.169.254"; L145: Endpoint["IPv6"] = "http://[fd00:ec2::254]";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist-lib/assets/dist-es-0JACG7BN.jsView on unpkg · L56

dist-lib/assets/vertex-BDiGCkcL.jsView file

4Cross-file remote execution chain: dist-lib/assets/vertex-BDiGCkcL.js spawns dist-lib/assets/schemas-BwC12rdj.js; helper contains network access plus dynamic code execution. L4: import { d as [redacted], p as UnsupportedFunctionalityError, t as AISDKError, u as NoSuchModelError } from "./dist-Bgd_i_qv.js"; L5: import { A as isAbortError, B as normalizeHeaders, D as getFromApi, F as lazySchema, G as postJsonToApi, L as loadOptionalSetting, O as getRuntimeEnvironmentUserAgent, R as loadSet... L6: import { t as require___vite_browser_external } from "./__vite-browser-external-mJKl6cJb.js"; ... L85: //#endregion L86: //#region ../../node_modules/.bun/gaxios@7.2.0+2b91fc17bf64bdfd/node_modules/gaxios/package.json L87: var package_exports$1 = /* @__PURE__ */ __exportAll({ ... L403: if (!obj || t

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-lib/assets/vertex-BDiGCkcL.jsView on unpkg · L4

dist-lib/pyodide/pyodide.asm.wasmView file

•path = dist-lib/pyodide/pyodide.asm.wasm kind = wasm_module sizeBytes = 9609998 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-lib/pyodide/pyodide.asm.wasmView on unpkg

dist-lib/pyodide/python_stdlib.zipView file

•path = dist-lib/pyodide/python_stdlib.zip kind = high_entropy_blob sizeBytes = 2552456 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = compressed_blob sizeBytes = 2552456 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-lib/pyodide/python_stdlib.zipView on unpkg

•path = dist-lib/pyodide/python_stdlib.zip kind = nested_archive_needs_inspection sizeBytes = 2552456 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-lib/pyodide/python_stdlib.zipView on unpkg

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2330166 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg

dist-lib/assets/pyodide-CtZbGtxv.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sctg/cline-chatbot@4.0.0-beta.20260705134313 matchedIdentity = npm:QHNjdGcvY2xpbmUtY2hhdGJvdA:4.0.0-beta.20260705134313 similarity = 0.483 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-lib/assets/pyodide-CtZbGtxv.jsView on unpkg