@tahc.ia/tahcia@1.0.14: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@tahc.ia/tahcia@1.0.14: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

tahcia.jsView file

10198var WebSocket = require_ws(); L10199: var { execSync } = require("child_process"); L10200: var path2 = require("path");

High

Child Process

Package source references child process execution.

tahcia.jsView on unpkg · L10198

27kStatusCode: /* @__PURE__ */ Symbol("status-code"), L28: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L29: NOOP: () => { ... L80: } else { L81: buf = Buffer.from(data); L82: toBuffer.readOnly = false; ... L92: }; L93: if (!process.env.WS_NO_BUFFER_UTIL) { L94: try { ... L144: * L145: * @private L146: */

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

tahcia.jsView on unpkg · L27

10990if (sessionId == "--version" || sessionId == "--v") { L10991: process.stdout.write(`v${VERSION} L10992: `); ... L10995: if (restArgs.length > 0 && restArgs[0] === "antigravity") { L10996: const { execSync } = require("child_process"); L10997: const https = require("https"); L10998: const subArgs = restArgs.slice(1);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

tahcia.jsView on unpkg · L10990

27kStatusCode: /* @__PURE__ */ Symbol("status-code"), L28: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L29: NOOP: () => { ... L80: } else { L81: buf = Buffer.from(data); L82: toBuffer.readOnly = false; ... L92: }; L93: if (!process.env.WS_NO_BUFFER_UTIL) { L94: try { ... L144: * L145: * @private L146: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

tahcia.jsView on unpkg · L27

10990Trigger-reachable command-output exfiltration chain: manifest.main -> tahcia.js L10990: if (sessionId == "--version" || sessionId == "--v") { L10991: process.stdout.write(`v${VERSION} L10992: `); ... L10995: if (restArgs.length > 0 && restArgs[0] === "antigravity") { L10996: const { execSync } = require("child_process"); L10997: const https = require("https"); L10998: const subArgs = restArgs.slice(1);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

tahcia.jsView on unpkg · L10990

27kStatusCode: /* @__PURE__ */ Symbol("status-code"), L28: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L29: NOOP: () => { ... L80: } else { L81: buf = Buffer.from(data); L82: toBuffer.readOnly = false; ... L92: }; L93: if (!process.env.WS_NO_BUFFER_UTIL) { L94: try { ... L144: * L145: * @private L146: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

tahcia.jsView on unpkg · L27

tahcia-macView file

•path = tahcia-mac kind = native_binary sizeBytes = 188872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tahcia-macView on unpkg

tahcia-antigravity.pyView file

•path = tahcia-antigravity.py kind = build_helper sizeBytes = 15970 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tahcia-antigravity.pyView on unpkg

Source & flagged code

8 flagged

tahcia.jsView file

Lines 7-47javascript

7 } catch (e) {

8 throw mod = 0, e;

9 }

10};

11

12// node_modules/ws/lib/constants.js

13var require_constants = __commonJS({

14 "node_modules/ws/lib/constants.js"(exports2, module2) {

15 "use strict";

16 var BINARY_TYPES = ["nodebuffer", "arraybuffer", "fragments"];

17 var hasBlob = typeof Blob !== "undefined";

18 if (hasBlob) BINARY_TYPES.push("blob");

19 module2.exports = {

20 BINARY_TYPES,

21 CLOSE_TIMEOUT: 3e4,

22 EMPTY_BUFFER: Buffer.alloc(0),

23 GUID: "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",

24 hasBlob,

25 kForOnEventAttribute: /* @__PURE__ */ Symbol("kIsForOnEventAttribute"),

26 kListener: /* @__PURE__ */ Symbol("kListener"),

27 kStatusCode: /* @__PURE__ */ Symbol("status-code"),

28 kWebSocket: /* @__PURE__ */ Symbol("websocket"),

29 NOOP: () => {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

tahcia.jsView on unpkg · L27

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

tahcia.jsView on unpkg · L27

Low

Weak Crypto

Package source references weak cryptographic algorithms.

tahcia.jsView on unpkg · L27

30 }

31 };

32 }

33});

34

35// node_modules/ws/lib/buffer-util.js

36var require_buffer_util = __commonJS({

37 "node_modules/ws/lib/buffer-util.js"(exports2, module2) {

38 "use strict";

39 var { EMPTY_BUFFER } = require_constants();

40 var FastBuffer = Buffer[Symbol.species];

41 function concat(list, totalLength) {

42 if (list.length === 0) return EMPTY_BUFFER;

43 if (list.length === 1) return list[0];

44 const target = Buffer.allocUnsafe(totalLength);

45 let offset = 0;

46 for (let i = 0; i < list.length; i++) {

47 const buf = list[i];

Lines 10178-10218javascript

10178var require_crypto_js = __commonJS({

10179 "node_modules/crypto-js/index.js"(exports2, module2) {

10180 (function(root, factory, undef) {

10181 if (typeof exports2

Lines 10970-11010javascript

10970 "compat": {

10971 "pluginApi": "2026.5.7"

10972 },

10973 "build": {

10974 "openclawVersion": "2026.5.7"

10975 }

10976 }

10977 };

10978 fs.writeFileSync

tahcia-macView file

•path = tahcia-mac kind = native_binary sizeBytes = 188872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tahcia-macView on unpkg

tahcia-antigravity.pyView file

•path = tahcia-antigravity.py kind = build_helper sizeBytes = 15970 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tahcia-antigravity.pyView on unpkg