Loading npm security reports…

@solidnumber/cli@2.24.11: Suspicious npm security report (Warn) | LPM Firewall

registry / @solidnumber/cli / 2.24.11

@solidnumber/cli@2.24.11

Be There — the system that answers, books, and takes payment when you can't. CLI + SDK + MCP tools for SMBs, agencies, and AI agents. solid clone plumber → working business in 30 seconds.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running solid install enables the Claude hook; running the CLI triggers first-run telemetry.

Impact

The hook can automatically supply package-generated context to future Claude sessions. The telemetry call enables installation-level tracking but no credential exfiltration was confirmed.

Mechanism

The install command saves a session-start hook that runs the context command later. First-run code stores a random machine identifier and posts it to the package service.

AI rationale

This is not an install-time attack, but an explicit command modifies a broad AI-agent control surface and establishes later automatic behavior. The silent first-run identifier transmission adds tracking risk, so a warning is appropriate.

Evidence

dist/commands/install.jsdist/commands/context.jsdist/lib/first-run.jsdist/index.js~/.claude/settings.json.solid/identity.json

Network endpoints1

api.solidnumber.com/api/v1/cli/identity

Decision evidence

Source & flagged code

22 flagged

package.jsonView file

Lines 29-69json

29 "scripts": {

30 "build": "tsc && node -e \"require('fs').cpSync('src/data','dist/data',{recursive:true})\"",

31 "postbuild": "ts-node scripts/generate-llms.ts",

32 "verify:llms": "ts-node scripts/generate-llms.ts --check",

33 "dev": "ts-node src/index.ts",

34 "start": "node dist/index.js",

35 "lint": "eslint src/**/*.ts",

36 "test": "jest --forceExit --detectOpenHandles",

37 "test:coverage": "jest --coverage --forceExit --detectOpenHandles",

38 "test:smoke": "jest --testPathPattern=integration --forceExit",

39 "test:contracts": "jest --testPathPattern='integration/(contracts|smoke|http-behavior)' --forceExit",

40 "test:security": "jest --testPathPattern=company-isolation --forceExit",

41 "verify:schemas": "ts-node scripts/verify-schemas.ts",

42 "audit": "npm audit --audit-level=high",

43 "audit:prod": "npm audit --omit=dev --audit-level=high",

44 "prepublish:check": "bash scripts/prepublish.sh",

45 "test:tarball": "bash scripts/test-tarball.sh",

46 "verify:deps": "node scripts/verify-runtime-deps.mjs",

47 "postpublish": "node scripts/bump-installers.mjs",

48 "prepublishOnly": "npm run check:release && npm run build && npm test && npm run test:contracts && npm run test:security && npm run audit:prod && npm run verify:deps && npm run check:counts",

49 "postinstall": "node -e \"try{if(!process.env.CI)console.log('\\n Solid# CLI installed. Get started: solid setup\\n')}catch(e){}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L49

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "sync:counts": "ts-node scripts/sync-counts.ts",

51 "check:counts": "ts-node scripts/sync-counts.ts --check",

52 "check:release": "node scripts/check-release-drift.mjs",

53 "eval": "node scripts/eval-suite/run.mjs",

54 "eval:reads": "node scripts/eval-suite/run.mjs --reads-only --json /tmp/solid-eval.json",

55 "eval:gate": "npm run eval:reads && node scripts/eval-suite/gate.mjs /tmp/solid-eval.json",

56 "eval:accept": "node scripts/eval-suite/gate.mjs /tmp/solid-eval.json --accept"

57 },

58 "keywords": [

59 "cli",

60 "ai",

61 "crm",

62 "business",

63 "saas",

64 "mcp",

65 "ai-agents",

66 "voice-ai",

67 "multi-tenant",

68 "payments",

69 "small-business",

dist/lib/esm-import.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.importESM = importESM;

4/**

5 * Import an ESM-only package from this CommonJS bundle.

6 *

7 * The CLI compiles with `module: CommonJS`, under which tsc rewrites a plain

dist/commands/completion.jsView file

Lines 1-29javascript

1"use strict";

2/**

3 * Shell completion for Solid CLI — generated dynamically from the live

4 * commander tree, so completions never drift from the registered commands.

5 *

6 * solid completion → zsh (default)

7 * solid completion --bash → bash

8 * solid completion --fish → fish

9 *

10 * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced

dist/lib/first-run.jsView file

Lines 36-76javascript

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod &&

dist/commands/visual.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * ================================================================================

4 * solid visual — Open the Visual Canvas in the browser

5 * ================================================================================

6 *

7 * Convenience command that opens /dashboard/cms/visual directly. Pair with

8 * `solid login` (session) so the browser lands authenticated and the canvas

9 * auto-selects the user's pages.

10 *

dist/commands/context.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: lve().then(() => __importstar(require('../lib/commerce-skill'))); installcommerceskill(process.cwd()); let jsonldpath = null; let jsonldbytes = 0; if (jsonlddoc) { jsonldpath = path.join(writeres.librarydir, '..', 'solid-context.jsonld'); fs.writefilesync(jsonldpath, jsonlddoc); jsonldbytes = buffer.bytelength(jsonlddoc, 'utf-8'); } if (options.iftenant || process.argv.includes('--raw')) { spinner?.stop()

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/context.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. w')) { spinner?.stop(); process.stdout.write((0, context_ladder_1.hooksessiontext)((0, context_ladder_1.pinnednotesfromspine)(spineres), writeres.spinepath)); return; } spinner?.succeed(chalk_1.default.green('ai context library ready')); printladdernextsteps(writeres, jsonpath, jsondoc ? buffer.bytelength(jsondoc, 'utf-8') : 0, jsonldpath, jsonldbytes); return; } catch (error) { spinner?.fail(chalk_1.default.red('failed to build ddc library')); console.

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/apply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/apply.js#virtual:normalized:round1View on unpkg

dist/commands/open.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/open.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/open.jsView on unpkg

dist/commands/demo.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/demo.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/demo.jsView on unpkg

dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/serve.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/serve.jsView on unpkg

dist/commands/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/feedback.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/feedback.jsView on unpkg

dist/commands/render.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/render.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/render.jsView on unpkg

dist/lib/offline-queue.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/offline-queue.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/offline-queue.jsView on unpkg

dist/commands/bids.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/bids.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/bids.jsView on unpkg

dist/commands/chains.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/chains.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/chains.jsView on unpkg

dist/commands/docs.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/docs.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/docs.jsView on unpkg

dist/commands/explore.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/explore.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/explore.jsView on unpkg

dist/commands/graph.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/graph.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/graph.jsView on unpkg

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/lib/esm-import.jsView file

18*/ L19: const dynamicEsmImport = new Function('specifier', 'return import(specifier)'); L20: function importESM(specifier) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/esm-import.jsView on unpkg · L18

dist/commands/completion.jsView file

9Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/commands/completion.js L9: * L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L183: const path = require('path'); L184: const shell = (process.env.SHELL || '').toLowerCase(); L185: const home = os.homedir(); L186: if (shell.includes('fish')) { ... L237: .description('Generate or install shell completion (reflects the live command tree)') L238: .option('--bash', 'Generate bash completion to stdout') L239: .option('--fish', 'Generate fish completion to stdout')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/completion.jsView on unpkg · L9

9* L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L183: const path = require('path'); L184: const shell = (process.env.SHELL || '').toLowerCase(); L185: const home = os.homedir(); L186: if (shell.includes('fish')) { ... L237: .description('Generate or install shell completion (reflects the live command tree)') L238: .option('--bash', 'Generate bash completion to stdout') L239: .option('--fish', 'Generate fish completion to stdout')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/completion.jsView on unpkg · L9

dist/lib/first-run.jsView file

56const telemetry_1 = require("./telemetry"); L57: const CONFIG_DIR = path.join(os.homedir(), '.solid'); L58: const IDENTITY_FILE = path.join(CONFIG_DIR, 'identity.json'); L59: function shouldSkip() { L60: if (process.env.SOLID_DISABLE_TELEMETRY === '1') L61: return true; L62: if (process.env.CI) L63: return true; ... L76: return null; L77: return JSON.parse(fs.readFileSync(IDENTITY_FILE, 'utf-8')); L78: } ... L99: function getApiBase() {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/lib/first-run.jsView on unpkg · L56

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/first-run.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/first-run.jsView on unpkg

dist/commands/visual.jsView file

21exports.visualCommand = void 0; L22: const child_process_1 = require("child_process"); L23: const chalk_1 = __importDefault(require("chalk")); ... L26: if (host) { L27: return host.startsWith('http') ? host : `https://${host}`; L28: } ... L30: // fall back to prod. Local dev users: SOLID_WEB_URL=http://localhost:3000 L31: const env = process.env.SOLID_WEB_URL || L32: (process.env.SOLID_API_URL ? process.env.SOLID_API_URL.replace('//api.', '//app.') : ''); ... L35: function openInBrowser(url) { L36: const platform = process.platform; L37: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start ""' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/visual.jsView on unpkg · L21

dist/commands/context.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/context.jsView on unpkg

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/apply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/apply.js#virtual:normalized:round1View on unpkg

dist/commands/open.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/open.jsView on unpkg

dist/commands/demo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/demo.jsView on unpkg

dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/serve.jsView on unpkg

dist/commands/feedback.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/feedback.jsView on unpkg

dist/commands/render.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/render.jsView on unpkg

dist/lib/offline-queue.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/offline-queue.jsView on unpkg

dist/commands/bids.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/bids.jsView on unpkg

dist/commands/chains.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/chains.jsView on unpkg

dist/commands/docs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/docs.jsView on unpkg

dist/commands/explore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/explore.jsView on unpkg

dist/commands/graph.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/graph.jsView on unpkg

Source & flagged code

22 flagged

package.jsonView file

Lines 29-69json

29 "scripts": {

30 "build": "tsc && node -e \"require('fs').cpSync('src/data','dist/data',{recursive:true})\"",

31 "postbuild": "ts-node scripts/generate-llms.ts",

32 "verify:llms": "ts-node scripts/generate-llms.ts --check",

33 "dev": "ts-node src/index.ts",

34 "start": "node dist/index.js",

35 "lint": "eslint src/**/*.ts",

36 "test": "jest --forceExit --detectOpenHandles",

37 "test:coverage": "jest --coverage --forceExit --detectOpenHandles",

38 "test:smoke": "jest --testPathPattern=integration --forceExit",

39 "test:contracts": "jest --testPathPattern='integration/(contracts|smoke|http-behavior)' --forceExit",

40 "test:security": "jest --testPathPattern=company-isolation --forceExit",

41 "verify:schemas": "ts-node scripts/verify-schemas.ts",

42 "audit": "npm audit --audit-level=high",

43 "audit:prod": "npm audit --omit=dev --audit-level=high",

44 "prepublish:check": "bash scripts/prepublish.sh",

45 "test:tarball": "bash scripts/test-tarball.sh",

46 "verify:deps": "node scripts/verify-runtime-deps.mjs",

47 "postpublish": "node scripts/bump-installers.mjs",

48 "prepublishOnly": "npm run check:release && npm run build && npm test && npm run test:contracts && npm run test:security && npm run audit:prod && npm run verify:deps && npm run check:counts",

49 "postinstall": "node -e \"try{if(!process.env.CI)console.log('\\n Solid# CLI installed. Get started: solid setup\\n')}catch(e){}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L49

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "sync:counts": "ts-node scripts/sync-counts.ts",

51 "check:counts": "ts-node scripts/sync-counts.ts --check",

52 "check:release": "node scripts/check-release-drift.mjs",

53 "eval": "node scripts/eval-suite/run.mjs",

54 "eval:reads": "node scripts/eval-suite/run.mjs --reads-only --json /tmp/solid-eval.json",

55 "eval:gate": "npm run eval:reads && node scripts/eval-suite/gate.mjs /tmp/solid-eval.json",

56 "eval:accept": "node scripts/eval-suite/gate.mjs /tmp/solid-eval.json --accept"

57 },

58 "keywords": [

59 "cli",

60 "ai",

61 "crm",

62 "business",

63 "saas",

64 "mcp",

65 "ai-agents",

66 "voice-ai",

67 "multi-tenant",

68 "payments",

69 "small-business",

dist/lib/esm-import.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.importESM = importESM;

4/**

5 * Import an ESM-only package from this CommonJS bundle.

6 *

7 * The CLI compiles with `module: CommonJS`, under which tsc rewrites a plain

dist/commands/completion.jsView file

Lines 1-29javascript

1"use strict";

2/**

3 * Shell completion for Solid CLI — generated dynamically from the live

4 * commander tree, so completions never drift from the registered commands.

5 *

6 * solid completion → zsh (default)

7 * solid completion --bash → bash

8 * solid completion --fish → fish

9 *

10 * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced

dist/lib/first-run.jsView file

Lines 36-76javascript

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod &&

dist/commands/visual.jsView file

Lines 1-41javascript

1"use strict";

2/**

3 * ================================================================================

4 * solid visual — Open the Visual Canvas in the browser

5 * ================================================================================

6 *

7 * Convenience command that opens /dashboard/cms/visual directly. Pair with

8 * `solid login` (session) so the browser lands authenticated and the canvas

9 * auto-selects the user's pages.

10 *

dist/commands/context.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/context.jsView on unpkg

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/apply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/apply.js#virtual:normalized:round1View on unpkg

dist/commands/open.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/open.jsView on unpkg

dist/commands/demo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/demo.jsView on unpkg

dist/commands/serve.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/serve.jsView on unpkg

dist/commands/feedback.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/feedback.jsView on unpkg

dist/commands/render.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/render.jsView on unpkg

dist/lib/offline-queue.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/offline-queue.jsView on unpkg

dist/commands/bids.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/bids.jsView on unpkg

dist/commands/chains.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/chains.jsView on unpkg

dist/commands/docs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/docs.jsView on unpkg

dist/commands/explore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/explore.jsView on unpkg

dist/commands/graph.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/graph.jsView on unpkg

@solidnumber/cli@2.24.11

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code