@toothfairyai/tfcode-darwin-x64-baseline@1.3.0: Suspicious npm

Loading npm security reports…

@toothfairyai/tfcode-darwin-x64-baseline@1.3.0: Suspicious npm | LPM Firewall

Source & flagged code

6 flagged

bin/app/dist/assets/codeql-DsOJ9woJ.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/app/dist/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

Long lines were clipped for display.

bin/app/dist/assets/session-BrmH3ve3.jsView file

21contains invisible/control Unicode U+202A (left-to-right embedding) `}),$.preventDefault();return}if($.key==="Enter"&&xt($))return;const z=$.ctrlKey&&!$.metaKey&&!$.altKey&&!$.shiftKey;if(Y.popover){if($.key==="Tab"){on(),$.preventDefault();return}const re=$.key==="ArrowUp"||$.key==="ArrowDown"||$.key==="En

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

bin/app/dist/assets/session-BrmH3ve3.jsView on unpkg · L21

bin/tfcodeView file

•path = bin/tfcode kind = native_binary sizeBytes = 106138176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/tfcodeView on unpkg

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

bin/app/dist/assets/index-D5mkkdQy.jsView file

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_source_file sizeBytes = 3046533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_cli_entrypoint sizeBytes = 3046533 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

Source & flagged code

6 flagged · loading source

bin/app/dist/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/app/dist/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

bin/app/dist/assets/session-BrmH3ve3.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

bin/app/dist/assets/session-BrmH3ve3.jsView on unpkg · L21

bin/tfcodeView file

•path = bin/tfcode kind = native_binary sizeBytes = 106138176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/tfcodeView on unpkg

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

bin/app/dist/assets/index-D5mkkdQy.jsView file

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_source_file sizeBytes = 3046533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_cli_entrypoint sizeBytes = 3046533 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

Source & flagged code

6 flagged

bin/app/dist/assets/codeql-DsOJ9woJ.jsView file

Lines 1-2javascript

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/app/dist/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

Long lines were clipped for display.

bin/app/dist/assets/session-BrmH3ve3.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

bin/app/dist/assets/session-BrmH3ve3.jsView on unpkg · L21

bin/tfcodeView file

•path = bin/tfcode kind = native_binary sizeBytes = 106138176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/tfcodeView on unpkg

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bin/app/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

bin/app/dist/assets/index-D5mkkdQy.jsView file

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_source_file sizeBytes = 3046533 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

•path = bin/app/dist/assets/index-D5mkkdQy.js kind = oversized_cli_entrypoint sizeBytes = 3046533 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/app/dist/assets/index-D5mkkdQy.jsView on unpkg

@toothfairyai/tfcode-darwin-x64-baseline@1.3.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code