1'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
L3: `);let S=s.queue;if(S&&typeof S=="object"){if(typeof S.maxAge=="string"){let G=O9(S.maxAge);G!==null&&(a.queueMaxAge=G);}typeof S.directory=="string"&&(a.queueDirectory=S.directory...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.cjsView on unpkg · L1 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.cjs:
'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
`)):typeof readline=="function"&&(V=readline(),V!==null&&(V+=`
`));if(!V)return null;K.input=vr(V);}return K.input.shift()},put_char:function(K,V){V===null||V===10?(RA(Wi(K.output,0)),K.output=[]):V!=0&&K.output.push(V);},flush:function(K){K.o...
`)):typeof readline=="function"&&(N=readline(),N!==null&&(N+=`
`));if(!N)return null;k.input=vl(N);}return k.input.shift()},put_char:function(k,N){N===null||N===10?(RA(_i(k.output,0)),k.output=[])
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.cjsView on unpkg 1'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.cjsView on unpkg · L1 1'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
L3: `);let S=s.queue;if(S&&typeof S=="object"){if(typeof S.maxAge=="string"){let G=O9(S.maxAge);G!==null&&(a.queueMaxAge=G);}typeof S.directory=="string"&&(a.queueDirectory=S.directory...
L4: /* [wrapped with `+U+`] */
...
L64: `,{body:Buffer.from(s),boundary:"----[redacted]"}}of.DemoData=vYA;function RYA(s){var n=function(f){var p=f.split("="),y=p[0].trim(),m=JSON.parse(p[1].trim(...
L65: `+a.extraStackTrace()),Ba(K)}fu
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.cjsView on unpkg · L1 1Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L1: 'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
L3: `);let S=s.queue;if(S&&typeof S=="object"){if(typeof S.maxAge=="string"){let G=O9(S.maxAge);G!==null&&(a.queueMaxAge=G);}typeof S.directory=="string"&&(a.queueDirectory=S.directory...
L4: /* [wrapped with `+U+`] */
...
L64: `,{body:Buffer.from(s),boundary:"----[redacted]"}}of.DemoData=vY
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.cjsView on unpkg · L1 1Detached bundled service listener: dist/index.cjs launches a Node helper and exposes a broad-bound HTTP listener.
L1: 'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
L3: `);let S=s.queue;if(S&&typeof S=="object"){if(typeof S.maxAge=="string"){let G=O9(S.maxAge);G!==null&&(a.queueMaxAge=G);}typeof S.directory=="string"&&(a.queueDirectory=S.directory...
L4: /* [wrapped with `+U+`] */
...
L64: `,{body:Buffer.from(s),boundary:"----[redacted]"}}of.DemoData=vYA;function RYA(s){
HighSpawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/index.cjsView on unpkg · L1 1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs
L1: 'use strict';var fs$1=require('fs'),path=require('path'),core=require('@testrelic/core'),rHA=require('net'),nHA=require('os'),buffer=require('buffer'),zlib=require('zlib'),child_pr...
L2: `),E}catch{}let u=path.dirname(n);if(u===n)break;n=u;}return null}function Z9(s){try{let n=fs$1.readFileSync(s,"utf-8"),a=JSON.parse(n);return typeof a!="object"||a===null||Array.i...
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.cjsView on unpkg · L1 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.cjsView on unpkg