Loading npm security reports…

@synotech/code@1.5.14: Suspicious npm security report (Warn) | LPM Firewall

registry / @synotech/code / 1.5.14

@synotech/code@1.5.14

syCode — terminal coding agent + team daemon sidecar for remote monitoring.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user installs the package and runs sycode in an interactive terminal, or runs sycode update.

Impact

Local daemon persistence, possible session and third-party config exposure to the vendor service, and remote installer execution when the user updates.

Mechanism

User-invoked coding-agent runtime with ambient daemon, cross-agent config import, and vendor cloud sync

AI rationale

There is no npm install-time hook, so this is not an unconsented install hijack, but the CLI is a large dual-use coding agent that autostarts a daemon, copies other-agent state, reads Claude account files, syncs transcripts to the vendor cloud, and can pipe a remote installer into a shell. Scanner coverage of that tree is incomplete, so residual risk stays as a warning rather than a clean or block.

Evidence

package.jsondist/src/cli.jsdist/src/daemon-manage.jsdist/extensions/sycode-background/src/core/anthropic-attribution.jsdist/extensions/sycode-mcp-adapter/config.jsdist/extensions/sycode-cloud.jsdist/src/defaults.js~/.config/sycode/daemon.json~/.claude.json~/.cursor/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Interactive sycode seeds agent defaults, patches installed plugin files at boot, talks to the vendor cloud, and starts a detached ambient daemon on the first TTY run.
The background extension reads ~/.claude.json oauth account fields and uses them for Anthropic attribution requests.
The MCP adapter enumerates Cursor, Claude, Codex, OpenCode, Windsurf, and VS Code MCP config paths for import.
sycode update runs curl of https://code.synotech.dev/install.sh piped into sh.
With a device token or license, the cloud extension posts session transcripts to https://code.synotech.dev/api.
First-run code copies legacy ~/.pi/agent state into the syCode agent directory, and the published tree is too large for complete static coverage.

Evidence against

package.json has no preinstall, install, or postinstall scripts; bins are user-invoked.
Inspected hosts are the vendor domain plus documented MCP and model-provider URLs, not an unrelated drop server.
Transcript sync, daemon autostart, and the curl installer are described as product behavior in README and code comments.
MCP import paths are reads of other tools' files; writes seen in config.js persist this agent's own config layers.
curl piped to sh runs only from the explicit update command, not at npm install.
No reviewer-directed jailbreak text or obfuscated payload loader showed up in the files inspected.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 475 file(s), 7.66 MB of source, external domains: 127.0.0.1, agent-plugins.org, api.anthropic.com, api.githubcopilot.com, chatgpt.com, code.synotech.dev, github.com, json-schema.org, mcp.context7.com, mcp.deepwiki.com, mcp.exa.ai, mcp.notion.com, models.dev, opencode.ai, openrouter.ai, registry.npmjs.org, search.parallel.ai, www.bing.com

Source & flagged code

23 flagged

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView file

Lines 1-21javascript

1import { spawn as nodeSpawn } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg · L1

3import { constants, existsSync } from 'node:fs';

4import { open } from 'node:fs/promises';

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { FUSION_CANDIDATE_OUTPUT_RECOVERY_PATH_ENV, FUSION_CHILD_MAX_PROVIDER_REQUESTS, FUSION_CHILD_MAX_TOOL_CALLS, FUSION_CHILD_RESULT_PREFIX, FUSION_CHILD_RESULT_SCHEMA_VERSION, FUSION_CHILD_SETTLEMENT_PREFIX, FUSION_CHILD_SETTLEMENT_SCHEMA_VERSION, FUSION_RESEARCH_ENABLED_ENV, FUSION_RUNTIME_GUARD_PREFIX, FUSION_RUNTIME_GUARD_SCHEMA_VERSION, FUSION_SOURCE_POLICY_PATH_ENV, FUSION_SOURCE_POLICY_SHA256_ENV, FUSION_TOOL_CALL_LOG_PATH_ENV, FUSION_TOOL_CALL_SEAL_SCHEMA_VERSION, FUSION_TOOL_CALL_SEAL_SUFFIX, FUSION_CHILD_MAX_TOTAL_TOOL_RESULT_BYTES, buildFusionChildSettlement, isRecoverableFusion ...

8import { FUSION_CLAUDE_CACHE_BREAKPOINT_LIMIT, FUSION_CLAUDE_CACHE_OBSERVATION_SCHEMA_VERSION, FUSION_CLAUDE_CACHE_RETENTION_ENV, } from './claude-cache.js';

9import { FUSION_FORBIDDEN_TOOLS, FUSION_NO_TOOLS_CAPABILITY, FUSION_INSPECT_TOOLS, FUSION_RESEARCH_TOOLS, FUSION_TOOL_CALL_LOG_SCHEMA_VERSION, FUSION_WEB_FETCH_TOOL_NAME, FusionError, addFusionUsage, cloneFusionUsage, createEmptyFusionUsage, } from './types.js';

10import { isJsonObject, parseJsonText } from '../common.js';

11import { FUSION_CANDIDATE_MAX_OUTPUT_BYTES, fusionJsonRenderedTextBytes, } from './output-contract.js';

12import { canonicalizeFusionPublicUrl, readFusionSourcePolicyFile } from './source-policy.js';

13import { assertWindowsCommandLineWithinLimit, piLaunchArgv, resolvePiLaunch, } from '../pi-launch.js';

14import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';

15// The response cap now applies to one final full answer, not cumulative Pi JSON events.

16export const FUSION_CHILD_STDOUT_LIMIT_BYTES = 32 * 1024 * 1024;

17export const FUSION_CHILD_STDERR_LIMIT_BYTES = 16 * 1024 * 1024;

18export const FUSION_CHILD_TIMEOUT_MS = 50 * 60 * 1000;

19/**

20 * Stale-action watchdog threshold.

21 *

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/fusion/pi-child.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg

dist/extensions/sycode-mcp-adapter/utils.jsView file

Lines 88-128javascript

88 return interpolateEnvVars(value.slice(1), environment);

89 return value.startsWith("!") ? value : interpolateEnvVars(value, environment);

90}

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView file

Lines 1640-1680javascript

1640function createOutput(model) {

1641 return {

1642 role: 'assistant',

1643 content: [],

1644 api: model.api,

1645 provider: model.provider,

1646 model: model.id,

dist/extensions/sycode-mcp-adapter/proxy-modes.jsView file

Lines 1-39javascript

1import { UrlElicitationRequiredError } from "@modelcontextprotocol/client";

2import { createRequire } from "node:module";

3import { getServerPrefix, isServerDisabled, parseUiPromptHandoff } from "./types.js";

4import { lazyConnect, markKeepAliveAfterConnect, notifyToolMetadataUpdated, updateServerMetadata, updateMetadataCache, getFailureAgeSeconds, updateStatusBar, clearFailure, recordFailure }

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView file

Lines 20-60javascript

20}

22function formatValue(value) {

23 if (typeof value === "string") return value;

24 try {

dist/extensions/sycode-mcp-adapter/ui-session.jsView file

Lines 63-103javascript

63 structuredContent,

64 };

65}

66async function openInBrowser(state, url, signal) {

67 throwIfAborted(signal);

68 try

dist/src/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// `sycode` — syCode terminal agent (white-label).

3// Spawns the bundled engine with syCode defaults (session dir, brand

4// extension, theme). User-facing output never names the engine.

5import { spawn } from "node:child_process";

6import { existsSync, mkdirSync, readFileSync } from "node:fs";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cloud.jsView file

Lines 1-32javascript

1/**

2 * sycode-cloud client (CLI side — ships in dist/, never imported by extensions;

3 * see extensions/sycode-cloud.ts for the install-safe twin).

4 *

5 * License handshake, manifest/config cache (24h TTL), tier filtering, and

6 * best-effort context sync. Offline-first: a failed handshake degrades to

7 * the persisted cache, then to an empty offline mode — never a brick.

8 */

9import { chmodSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView file

1import { createHash } from 'node:crypto'; L2: import { lookup as nodeLookup } from 'node:dns/promises'; L3: import * as http from 'node:http'; ... L6: import { performance } from 'node:perf_hooks'; L7: import { TextDecoder } from 'node:util'; L8: export const FUSION_WEB_FETCH_TIMEOUT_MS = 90_000; ... L371: response.once('end', () => { L372: settleResolve({ kind: 'success', status, contentType, body: Buffer.concat(chunks, bytesRead) }); L373: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView on unpkg · L1

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View on unpkg

dist/extensions/sycode-background/src/core/registry.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/registry.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/registry.jsView on unpkg

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-mcp-adapter/mcp-auth.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView on unpkg

extensions/sycode-background/src/core/registry.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-background/src/core/registry.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/registry.tsView on unpkg

extensions/sycode-mcp-adapter/mcp-auth.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-mcp-adapter/mcp-auth.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/mcp-auth.tsView on unpkg

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-mcp-adapter/request-headers-command.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView on unpkg

dist/src/daemon-manage.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/src/daemon-manage.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/daemon-manage.jsView on unpkg

extensions/sycode-background/src/core/fusion/pi-child.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-background/src/core/fusion/pi-child.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/fusion/pi-child.tsView on unpkg

extensions/sycode-mcp-adapter/request-headers-command.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-mcp-adapter/request-headers-command.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/request-headers-command.tsView on unpkg

dist/extensions/sycode-background/src/core/attested-pi-run.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/attested-pi-run.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/attested-pi-run.jsView on unpkg

Source & flagged code

23 flagged · loading source

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView file

1import { spawn as nodeSpawn } from 'node:child_process'; L2: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg

dist/extensions/sycode-mcp-adapter/utils.jsView file

108const result = spawnSync(value.slice(1), { L109: shell: true, L110: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/extensions/sycode-mcp-adapter/utils.jsView on unpkg · L108

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView file

1660try { L1661: const dynamicImport = new Function('specifier', 'return import(specifier)'); L1662: const mod = await dynamicImport('@earendil-works/pi-ai/anthropic');

High

Eval

Package source references dynamic code evaluation.

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView on unpkg · L1660

dist/extensions/sycode-mcp-adapter/proxy-modes.jsView file

19import { getInputRequiredNeedsUiDetails } from "./errors.js"; L20: const require = createRequire(import.meta.url); L21: const MAX_REGEX_SEARCH_QUERY_LENGTH = 256;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extensions/sycode-mcp-adapter/proxy-modes.jsView on unpkg · L19

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView file

40if (value.type === "image" && typeof value.data === "string" && typeof value.mimeType === "string") { L41: return { type: "image", data: value.data, mimeType: value.mimeType }; L42: }

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView on unpkg · L40

dist/extensions/sycode-mcp-adapter/ui-session.jsView file

83function isRemoteSession() { L84: return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY); L85: } ... L87: return new Promise((resolve) => { L88: execFile("who", { encoding: "utf8", timeout: 2000 }, (error, out) => { L89: if (error) { ... L98: return new Promise((resolve) => { L99: const socket = net.connect({ host: "127.0.0.1", port: 24543 }); L100: const done = (ok) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/extensions/sycode-mcp-adapter/ui-session.jsView on unpkg · L83

dist/src/cli.jsView file

4// extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L30: // no upstream version check, no install telemetry ping, no opencode web panel. L31: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L32: process.env.PI_TELEMETRY ??= "0"; ... L36: // Share links open our viewer, never the upstream one. L37: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L38: const argv = process.argv.slice(2); L39: if (argv.includes("--help") || argv.includes("-h")) { L40: process.stdout.write(SYCODE_HELP); L41: process.exit(0);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cli.jsView on unpkg · L4

4Trigger-reachable chain: manifest.bin -> dist/src/cli.js L4: // extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L30: // no upstream version check, no install telemetry ping, no opencode web panel. L31: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L32: process.env.PI_TELEMETRY ??= "0"; ... L36: // Share links open our viewer, never the upstream one. L37: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L38: const argv = process.argv.slice(2); L39: if (argv.includes("--help") || argv.includes("-h")) { L40: process.stdout.write(SYCODE_HELP); L41: process.exit(0);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/cli.jsView on unpkg · L4

•matchType = token_shingles matchedPackage = @synotech/code@1.5.3 matchedPath = dist/src/cli.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

dist/src/cloud.jsView file

12import { SYCODE_BRAND } from "./brand.js"; L13: export const CLOUD_BASE_URL = process.env.SYCODE_CLOUD_URL ?? "https://code.synotech.dev/api"; L14: export const CLOUD_APP_ID = "sycode-cloud"; ... L18: export const CLOUD_CACHE_TTL_MS = 24 * 60 * 60 * 1000; L19: const dir = () => join(homedir(), ".config", SYCODE_BRAND.name); L20: export const licensePath = () => process.env.SYCODE_LICENSE_FILE ?? join(dir(), "license"); ... L28: try { L29: const parsed = JSON.parse(readFileSync(devicePath(), "utf8")); L30: return typeof parsed.device_token === "string" && parsed.device_token ? parsed.device_token : null; ... L177: }, L178: body: JSON.stringify(params), L179: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cloud.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/src/cloud.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cloud.jsView on unpkg

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView on unpkg · L1

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View on unpkg

dist/extensions/sycode-background/src/core/registry.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/registry.jsView on unpkg

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView on unpkg

extensions/sycode-background/src/core/registry.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/registry.tsView on unpkg

extensions/sycode-mcp-adapter/mcp-auth.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/mcp-auth.tsView on unpkg

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView on unpkg

dist/src/daemon-manage.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/daemon-manage.jsView on unpkg

extensions/sycode-background/src/core/fusion/pi-child.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/fusion/pi-child.tsView on unpkg

extensions/sycode-mcp-adapter/request-headers-command.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/request-headers-command.tsView on unpkg

dist/extensions/sycode-background/src/core/attested-pi-run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/attested-pi-run.jsView on unpkg