registry / @visulima/vis / 1.0.0

@visulima/vis@1.0.0

A monorepo dev toolkit — task runner, remote caching, security scanning, git hooks, and AI agent integrations — powered by @visulima/task-runner

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 234 file(s), 6.30 MB of source, external domains: anolilab.com, api.deps.dev, api.github.com, api.npmjs.org, api.osv.dev, api.snyk.io, api.socket.dev, bitbucket.org, bloom.example.com, bun.sh, cdn.jsdelivr.net, crates.io, cyclonedx.org, endevco.github.io, git.sr.ht, github.com, gitlab.com, in-toto.io, json.schemastore.org, jsr.io, mirror.example.com, npmjs.com, npms.io, npmx.dev, nvd.nist.gov, osv-vulnerabilities.storage.googleapis.com, osv.dev, pypi.org, raw.githubusercontent.com, react.dev, registry.npmjs.org, repo1.maven.org, slsa.dev, tailwindcss.com, token.actions.githubusercontent.com, visulima.com, www.npmjs.com, www.w3.org

Source & flagged code

10 flagged

bin/vis.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// Native front-end launcher for `vis`.

3//

4// This is the npm `bin` entry. Its only jobs are to (1) route the small set of

5// natively-implemented commands to the platform Rust binary, and (2) fall

6// through to the existing in-process Node CLI for everything else. The

7// fall-through path is byte-identical to running `dist/bin.js` directly, so the

8// launcher adds no extra Node boot for delegated commands — it `import()`s the

9// same entry in the same process.

Medium

Source & flagged code

10 flagged · loading source

bin/vis.mjsView file

14L15: import { spawnSync } from "node:child_process"; L16: import { readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/vis.mjsView on unpkg · L14

7// fall-through path is byte-identical to running `dist/bin.js` directly, so the L8: // launcher adds no extra Node boot for delegated commands — it `import()`s the L9: // same entry in the same process.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vis.mjsView on unpkg · L7

dist/packem_chunks/handler77.jsView file

42`;await at(e,t)},Un=async s=>{const e=process.env.HISTFILE??oe(vt(),".bash_history");await at(e,`${jt(s)} L43: `)},Vn=async s=>{const e=process.env.VIS_PSREADLINE_HISTORY,t=process.env.APPDATA;if(e===void 0&&(t===void 0||t===""))return;const r=e??oe(t,"Microsoft","Windows","PowerShell","PSR... L44: `)},Hn=async s=>{const e=oe(vt(),".local","share","fish","fish_history"),t=`- cmd: ${s.replaceAll("\\","\\\\").replaceAll(`

High

Shell

Package source references shell execution.

dist/packem_chunks/handler77.jsView on unpkg · L42

1Cross-file remote execution chain: dist/packem_chunks/handler77.js spawns dist/packem_shared/env-DdQRnEIy.js; helper contains network access plus dynamic code execution. L1: import{createRequire as rr}from"node:module";import{m as oe,H as js,J as nr,y as or,T as $s,v as ar,l as cr}from"../packem_shared/index-CE6MsgcV.js";import{expandAffected as lr,get... L2: Delete this file to be asked again. L3: `)}catch{}},Hi=(s,e="npm")=>{const t=`${e} install`;if((e==="pnpm"||e==="aube")&&Ae(oe(s,st))&&qi(s))return{file:st,installCommand:t};const r=oe(s,"package.json"),o=As(r);if(!o)ret... L4: `)}catch{return}return{file:"package.json",installCommand:t}},zi=async(s,e)=>{const t=Ui(s,e.projectManifests);if(!t.present||t.alreadyOverridden||t.declined)return!1;const r=Ss({i... L5: `),cn=async s=>{if(s.length===0||!process.stdin.isTTY||!process.stdout.isTTY)return;const e=Ss({input:process.stdin,output:process.stdout});try{process.stdout.write(`Available targ... L6: `);for(const[o,a]of s.entries())process.stdout.write(` ${String(o+1).padStart(2," ")}. ${a} ... L14: ${p} L15: ${s}`}catch{return s}},xn={delimiter:" ",language:{d:()=>" d",future:"in %s",h:()=>" h",m:()=>" m",mo:()=>" mo",ms:()=>" …

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/packem_chunks/handler77.jsView on unpkg · L1

dist/packem_shared/docker-BYqiD711.jsView file

12`+o)),h},Qr=d,Qr}var en,Ci;function Le(){if(Ci)return en;Ci=1;var l=rr(),d=["kind","resolve","construct","instanceOf","predicate","represent","defaultStyle","styleAliases"],A=["sca... L13: \r`;function h(m){if(m===null)return!1;var S,E,Y=0,y=m.length,b=o;for(E=0;E<y;E++)if(S=b.indexOf(m.charAt(E)),!(S>64)){if(S<0)return!1;Y+=6}return Y%8===0}function e(m){var S,E,Y=m... L14: `:r===118?"\v":r===102?"\f":r===114?"\r":r===101?"\x1B":r===32?" ":r===34?'"':r===47?"/":r===92?"\\":r===78?"":r===95?" ":r===76?"\u2028":r===80?"\u2029":""}function Oe(r){return ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/packem_shared/docker-BYqiD711.jsView on unpkg · L12

dist/packem_chunks/cli-main.jsView file

1import{createRequire as FC}from"node:module";import{d as WC,c as Lr,V as IC,h as _C,e as zC,r as KC}from"../packem_shared/index-jJNulo5i.js";import{T as ui,F as Gf,m as L,e as Jl,H... L2: `))}};const Pl=["bash","zsh","fish","powershell"],Nl=["node","bun","deno"],FY=e=>"Deno"in e,QY=e=>"Bun"in e,$p=()=>FY(globalThis)?"deno":QY(globalThis)?"bun":"node",Zp=e=>{const i=... ... L4: `)),s}else{const r=["Failed to generate completion script",`Error: ${s instanceof Error?s.message:String(s)}`,"","Troubleshooting:"," • Ensure @bomb.sh/tab is installed: pnpm add ... L5: `))}}},name:"completion",options:[{defaultOption:!0,defaultValue:Zp(),description:"Shell type (bash, zsh, fish, powershell). Defaults to current shell if detected.",name:"shell",ty... L6: `);let n=0;for(;i[n]&&i[n].trim().match(/^(#|$)/);)n++;const o=i.length;let a=n+1;for(;a<o&&i[a].trim();)a++;return i.slice(n,a).join(" ").trim()}return jd}var mm={dependancies:"de... L7: ${o.join(`\r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/packem_chunks/cli-main.jsView on unpkg · L1

1import{createRequire as FC}from"node:module";import{d as WC,c as Lr,V as IC,h as _C,e as zC,r as KC}from"../packem_shared/index-jJNulo5i.js";import{T as ui,F as Gf,m as L,e as Jl,H... L2: `))}};const Pl=["bash","zsh","fish","powershell"],Nl=["node","bun","deno"],FY=e=>"Deno"in e,QY=e=>"Bun"in e,$p=()=>FY(globalThis)?"deno":QY(globalThis)?"bun":"node",Zp=e=>{const i=... L3: `);e.info(n)},UY={description:"Generate shell completion scripts",env:[{description:"Shell path (Unix-like systems). Used for shell detection.",name:"SHELL",type:String},{descripti... L4: `)),s}else{const r=["Failed to generate completion script",`Error: ${s instanceof Error?s.message:String(s)}`,"","Troubleshooting:"," • Ensure @bomb.sh/tab is installed: pnpm add ... L5: `))}}},name:"completion",options:[{defaultOption:!0,defaultValue:Zp(),description:"Shell type (bash, zsh, fish, powershell). Defaults to current shell if detected.",name:"shell",ty... L6: `);let n=0;for(;i[n]&&i[n].trim().match(/^(#|$)/);)n++;const o=i.length;let a=n+1;for(;a<o&&i[a].trim();)a++;return i.slice(n,a).join(" ").trim()}return jd}var mm={dependancies:"de... L7: ${o.join(`\r ... L262: \x1B[2mtip: ${t}\x1B[0m L263: `),n.lastGlobal

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/packem_chunks/cli-main.jsView on unpkg · L1

dist/packem_shared/env-DdQRnEIy.jsView file

1import{createRequire as et}from"node:module";import{m as ii,a as dt,f as mu}from"./index-CE6MsgcV.js";import{a as rt}from"./readJsonSync-DuMMeB3s-ihoybKvs.js";const nt=et(import.me... L2: `);for(const g of u){const d=g.trim();if(d)try{const h=JSON.parse(d.endsWith("}")?d:`${d}}`),s=`${h.namespace?`${h.namespace}/`:""}${h.name}`,l=`${s}@${h.version}`;if(!a.has(l))con... L3: `)},Dt=()=>{const i=So();if(!mu(i))return 0;const o=ju(i).filter(e=>e.endsWith(".json"));for(const e of o)wu(ii(i,e),{force:!0});return o.length},Tt=()=>{const i=So();if(!mu(i))ret... L4: `),XX=(i,o={})=>{const e=Bt(i,o.minimumScore);if(e)return{clearCache:Dt,displayName:"Socket.dev",fetchReports:n=>Ct(n,e),getCacheStats:Tt,id:"socket"}},Mt=[161,161,164,164,167,168,...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/packem_shared/env-DdQRnEIy.jsView on unpkg · L1

dist/packem_chunks/cache-attestation.jsView file

1import{createRequire as _}from"node:module";import{loadOptionalSigstore as g}from"./loader.js";const R=_(import.meta.url),c=typeof globalThis<"u"&&typeof globalThis.process<"u"?glo...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/packem_chunks/cache-attestation.jsView on unpkg · L1

dist/packem_chunks/publish-guards.jsView file

1package = @visulima/vis; repositoryIdentity = visulima; dependency = @visulima/secret-scanner L1: import{createRequire as v}from"node:module";const _=v(import.meta.url),d=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,g=t=>{if(typeof d<"u"&&d.ve...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/packem_chunks/publish-guards.jsView on unpkg · L1

Findings

8 High6 Medium5 Low

HighChild Processbin/vis.mjs

HighShelldist/packem_chunks/handler77.js

HighSame File Env Network Executiondist/packem_shared/env-DdQRnEIy.js

HighCommand Output Exfiltrationdist/packem_chunks/cli-main.js

HighSandbox Evasion Gated Capabilitydist/packem_chunks/cache-attestation.js

HighCopied Package Dependency Bridgedist/packem_chunks/publish-guards.js

HighCross File Remote Execution Contextdist/packem_chunks/handler77.js

HighObfuscated

MediumDynamic Requirebin/vis.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/packem_chunks/cli-main.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowEvaldist/packem_shared/docker-BYqiD711.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

dist/packem_chunks/handler77.jsView file

Lines 22-62javascript

22`);const fe=he(K.createElement(Ls,{cached:b.cached,failed:b.failed,failedIds:H,projectNames:a,retriedIds:b.retriedIds.length>0?b.retriedIds:void 0,succeeded:b.succeeded,targets:e.targets,tasks:u,took:M}),{columns:te});if(process.stdout.write(`${fe}

23`),o!=="quiet"){const W=[...b.rows.filter(Y=>Y.status!=="failure"),...b.rows.filter(Y=>Y.status==="failure")];for(const Y of W){if(Y.status==="running"||Y.status==="pending")continue;const ce=b.outputs.get(Y.taskId);if(!ce?.trim())continue;const{color:re,icon:ae}=_e(Y.status),ne=he(K.createElement(c,null,`

24`,K.createElement(c,{bold:!0,color:re},` ${ae} vis run ${Y.taskId}`)),{columns:te});process.stdout.write(`${ne}

26`);const U=ce.trim().split(`

27`).map(_=>` ${_}`).join(`

28`);process.stdout.write(`${U}

29`)}}};let w;const A=()=>{w&&(clearInterval(w),w=void 0)};return{lifeCycle:{endCommand(){j(),h.markDone(),w||(w=setInterval(()=>{},1e3))},endTasks(b){h.endTasks(b)},printCacheDisabledByTask(b){h.addOutput(b.id,`ⓘ caching disabled by task via disableCache()

30`)},printEmptyFingerprintWarning(b,M){h.addOutput(b.id,`ⓘ caching skipped — ${M}

31`)},printSelfModifyingSkip(b,M){h.addOutput(b.id,`ⓘ caching skipped — task modified its own input${M.length===1?"":"s"} (${M.join(", ")})

32`)},printTaskTerminalOutput(b,M,H){h.getSnapshot().outputs.has(b.id)||h.addOutput(b.id,H)},startCommand(){process.on("SIGINT",x),process.on("SIGTERM",x),w||(w=setInterval(()=>{},1e3)),$=Pr(K.createElement(Dn,{autoExitSeconds:l,onRetryService:r,parallelSlots:p,projectNames:a,serviceDockStore:i,stdinRegistry:d??new Map,store:h,targets:e.targets,tasks:u}),{alternateScreen:!0,exitOnCtrlC:!1,interactive:!0,patchConsole:!0}),$.waitUntilExit().then(()=>{A(),S(),I(),process.removeListener("SIGINT",x),process.removeListener("SIGTERM",x),O(),R()}).catch(()=>{A(),S(),I(),process.removeListener("SIGINT",x ...

33 With additional flags:

34`);for(const[i,d]of a)process.stdout.write(`${hn(" ",i,d)}

35`)}process.stdout.write(`

36`)}startTasks(e){const t=process.stdout.columns||80;for(const r of e){const o=he(K.createElement(c,null,K.createElement(c,{dimColor:!0},">"),` ${r.id}`),{columns:t});process.stdout.write(`${o}

37`)}}endTasks(e){const t=process.stdout.columns||80;for(const r of e){this.#o.set(r.task.id,r),r.status==="failure"?this.#i.push(r):Ne(r.status)&&this.#t.push(r),r.retryAttempts&&r.retryAttempts>0&&this.#n.push(r);const

38`)}}#d(e){const t=process.stdout.columns||80,r=he(K.createElement(c,{dimColor:!0},` ⓘ ${e}`),{columns:t});process.stdout.write(`${r}

39`)}printCacheDisabledByTask(e){this.#d(`${e.id}: caching disabled by task via disableCache()`)}printSelfModifyingSkip(e,t){this.#d(`${e.id}: caching skipped — task modified its own input${t.length===1?"":"s"} (${t.join(", ")})`)}printEmptyFingerprintWarning(e,t){this.#d(`${e.id}: caching skipped — ${t}`)}printTaskTerminalOutput(e,t,r){if(Gn(e,this.#c)==="quiet"&&(t==="success"||Ne(t)))return;const o=t==="failure"?Ns(r,{color:!process.env.NO_COLOR,cwd:process.cwd()}):r;if(this.#a){this.#a.printTaskTerminalOutput(e,t,o);return}Sn(e.id,t,o,this.#l)}endCommand(){const e=De(Date.now()-this.#u),t=th ...

40`);const r=process.stdout.columns||80,o=he(K.createElement(Ls,{cached:this.#t.length,failed:this.#i.length,failedIds:this.#i.map(a=>a.task.id),projectNames:this.#e,retriedIds:this.#n.length>0?this.#n.map(a=>a.task.id):void 0,skippedIds:t.length>

41`)}}const qn=async s=>{if(process.env.VIS_NO_SHELL_HISTORY)return;if(Ii()==="win32"){try{await Vn(s)}catch{}return}const e=process.env.SHELL;if(!e)return;const t=nr(e);try

42`;await at(e,t)},Un=async s=>{const e=process.env.HISTFILE??oe(vt(),".bash_history");await at(e,`${jt(s)}

43`)},Vn=async s=>{const e=process.env.VIS_PSREADLINE_HISTORY,t=process.env.APPDATA;if(e===void 0&&(t===void 0||t===""))return;const r=e??oe(t,"Microsoft","Windows","PowerShell",

44`)},Hn=async s=>{const e=oe(vt(),".local","share","fish","fish_history"),t=`- cmd: ${s.replaceAll("\\","\\\\").replaceAll(`

High

Shell

Package source references shell execution.

dist/packem_chunks/handler77.jsView on unpkg · L42

45`,String.raw`\n`).replaceAll("\r",String.raw`\r`)}

46 when: ${Math.floor(Date.now()/1e3)}

47`;await at(e,t)},zn=s=>{const{killGracePeriodMs:e=5e3,onTimeout:t,sendSignal:r,timeoutMs:o}=s;if(o<=0)return{cancel:()=>{}};const a=Math.max(e,

48`),Kn=s=>{s.write(`${Jn}

49`)},Qn=async(s,e)=>{e.write("filter projects (empty to cancel) > ");const t=s,r=t.isRaw===!0;if(r)try{t.setRawMode?.(!1)}catch{}return await new Promise(o=>{let a="";const i=d=>{a+=typeof d=="string"?d:d.toString("utf8");const u=a.indexOf(`

50`);if(u===-1)return;const f=a.slice(0,u).replace(/\r$/,"").trim();if(s.off("data",i),r)try{t.setRawMode?.(!0)}catch{}o(f.length>0?f:void 0)};s.on("data",i)})},Xn=s=>{const{handlers:e}=s,t=s.input??process.stdin,r=s.output??process.stdout,o=s.promptFilter??Qn;if(!t||t.isTTY===!1)return{close:()=>{}};Vr(t);const a=t.isRaw===!0;try{t.setRawMode?.(!0)}catch{return{close:()=>{}}}typeof t.resume=="function"&&t.resume();let i=!1;const d=async h=>{if(h.ctrl===!0&&h.name==="c"){await e.onQuit();return}if(!i)switch(h.name){case"?":case"h":{await e.onHelp();break}case"a":{await e.onClearFilter();break}ca ...

51`):await e.onFilter(p)}finally{i=!1}break}case"q":{await e.onQuit();break}case"r":{await e.onRerun();break}case"return":{await e.onRerun();break}}},u=(h,p)=>{d(p).catch(l=>{r.write(`[vis watch] keybind handler failed: ${l.message}

52`)})},f=t;return f.on("keypress",u),{close:()=>{if(f.off("keypress",u),!a)try{t.setRawMode?.(!1)}catch{}const h=t;if(typeof h.pause=="function")try{h.pause()}catch{}}}},Zn=s=>

53`),o=r.pop()??"";this.#t.set(e,o);for(const a of r)this.#l(e,a)}notifyRegistryStarting(e){this.#s.starting(e)}notifyRegistryStarted(e,t){this.#s.started(e,t)}onRegistryTaskStarted(e){this.#r.get(e)?.mode==="registry"&&this.notifyRegistryStarting(e)}async onRegistryTaskClosed(e,t,r){if(this.#r.get(e)?.mode!=="registry")return;if(r||t!==0){this.notifyRegistryFailed(e,"exit-code",{exitCode:t,killed:r});return}const o=await Kr(this.#i,e);if(!o){this.notifyRegistryFailed(e,"missing-registry-entry");return}const{config:a}=o,i=a.readiness?.tcp?.port??a.port??0,d=a.readiness?.tcp?.host??"127.0.0.1";th ...

54`)}#u(e,t){let r;try{r=JSON.parse(t)}catch{this.#s.log(e,`${Qe+t}

55`);return}switch(r.event){case"failed":{const o=typeof r.reason=="string"?r.reason:"unknown",a={};for(const[i,d]of Object.entries(r))i!=="event"&&i!=="id"&&i!=="reason"&&(a[i]=d);this

56`)}}#d(e){const t=this.#r.get(e);if(t?.ephemeral===void 0)return;this.#f(e,t.ephemeral.logFile);const r=ws(t.ephemeral.pidFile);r!==null&&this.#p(e,r)}#f(e,t){if(this.#o.has(e)||!Ae(t))return;

57`))d.length!==0&&this.#w(e,d);this.#s.log(e,i)}}catch{}}#w(e,t){const r=this.#n.get(e)??[];for(r.push(t);r.length>ms;)r.shift();this.#n.set(e,r)}#p(e,t){if(this.#a.has(e))return;const r={pid:t,timer:setInterval(()=>{if(!fo(t)){const o=[...this.#n.get(e)??[]];this.#h(e),this.#s.crashed(e,o)}},ho)};this.#a.set(e,r)}#h(e){const t=this.#o.get(e);if(t){clearInterval(t.pollTimer);try{Wr(t.fd)}catch{}this.#o.delete(e)}const r=this.#a.get(e);r&&(clearInterval(r.timer),this.#a.delete(e))}#y(e,t){if(t===void 0)return;const r=ws(t.pidFile);if(r!==null)try{process.kill(-r,"SIGTERM")}catch{}const o=pi("nod ...

58`),o=r.pop()??"";this.#t.set(e,o);for(const a of r)this.#l(e,a)}async#v(e,t){if(t!==void 0){try{await Qr({id:e,workspaceRoot:this.#i})}catch{}try{const r=await Xr({command:t.command,config:t.config,cwd:t.cwd,env:t.env,id:e,workspaceRoot:this.#i}),o

59import { closeSync, openSync, readFileSync, readSync, statSync, writeFileSync } from "node:fs";

60import { createConnection } from "node:net";

62const cfgPath = process.argv[2];

Long lines were clipped for display.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/packem_chunks/handler77.jsView on unpkg · L1

dist/packem_shared/docker-BYqiD711.jsView file

Lines 1-32javascript

1import{createRequire as Qo}from"node:module";import{m as Ie,f as ia,y as oa,H as jn,T as fi,a as aa}from"./index-CE6MsgcV.js";import{h as sa,L as ua}from"./public-api-WqUCiyIe.js";import{a as ro}from"./readJsonSync-DuMMeB3s-ihoybKvs.js";const ea=Qo(import.meta.url),zt=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,ta=l=>{if(typeof zt<"u"&&zt.versions&&zt.versions.node){const[d,A]=zt.versions.node.split(".").map(Number);if(d>22||d===22&&A>=3||d===20&&A>=16)return zt.getBuiltinModule(l)}return ea(l)},{rmSync:_n,existsSync:eo,readFileSync:li,cpSync:to,lstatSync:ra ...

2`&&(o=!1,d+=g);continue}if(h){g==="*"&&C==="/"&&(h=!1,e+=1);continue}if(A){if(g==="\\"){d+=g,C!==void 0&&(d+=C,e+=1);continue}g==='"'&&(A=!1),d+=g;continue}if(g==='"'){A=!0,d+=g;continue}if(g==="/"&&C==="/"){o=!0,e+=1;continue}if(g==="/"&&C==="*"){h=!0,e+=1;continue}d+=g}return d},ha=l=>{const d=[];for(const A of[l.dependencies,l.devDependencies,l.optionalDependencies,l.peerDependencies])if(A)for(const[o,h]of Object.entries(A))typeof h=="string"&&d.push({name:o,spec:h});return d},da=l=>{for(const d of l)if(typeof d=="object"&&!Array.isArray(d))return d},ga=l=>{if(!l)return[];const d=[];for(con ...

3`,message:`bun.lock: kept ${b}/${y} packages (dropped ${v})`,status:"pruned"}},Vr="node_modules/",ya=(l,d,A)=>{let o=d;for(;;){const h=o===""?`${Vr}${A}`:`${

4`,message:`${d}: kept ${y}/${Y} entries (dropped ${b})`,status:"pruned"}};var Kr={},xe={},Zr,di;function ba(){if(di)return Zr;di=1;function l(o,h){function e(){this.constructor=o}e.prototype=h.prototype,o.prototype=new e}function d(o,h,e,g){this.message=o,this.expected=h,this.found=e,this.location=g,this.name="SyntaxError",typeof Error.captureStackTrace=="function"&&Error.captureStackTrace(this,d)}l(d,Error),d.buildMessage=function(o,h){var e={literal:function(y){return'"'+C(y.text)+'"'},class:function(y){var b="",v;for(v=0;v<y.parts.length;v++)b+=y.parts[v]instanceof Array?m(y.parts[v][0])+"- ...

5`,_r=ce(`\\

6`,!1),$r=function(){return""},yt="\\",vt=ce("\\",!1),jr=/^[\\$"`]/,ar=We(["\\","$",'"',"`"],!1

7`},nt="\\r",Lr=ce("\\r",!1),Fr=function(){return"\r"},Et="\\t",cr=ce("\\t",!1),lr=function(){return" "},oe="

8`,"\\n"],["\r","\\r"],[" ","\\t"],["\v","\\v"],["\0","\\0"]]),b=new Map([["\\","\\\\"],["$","\\$"],['"','\\"'],...Array.from(y,([x,Z])=>[x,`"$'${Z}'"`])]),v=x=>y.get(x)??`\\x${x.charCodeAt(0).toString(16).padStart(2,"0")}`,M=x=>b.get(x)??`"$'${v(x)}'"`;function re(x){const Z=(q,ue)=>ue?`"${q}"`:q,te=q=>q===""?"''":q.match(/[()}<>$|&;"'\n\t ]/)?q.match(/['\t\p{C}]/u)?q.match(/'/)?`"${q.replace(/["$

9\u2028\u2029`.indexOf(this.buffer.charAt(e-1))===-1;)if(e-=1,this.position-e>o/2-1){h=" ... ",e+=5;break}for(g="",C=this.position;C<this.buffer.length&&`\0\r

10\u2028\u2029`.indexOf(this.buffer.charAt(C))===-1;)if(C+=1,C-this.position>o/2-1){g=" ... ",C-=5;break}return m=this.buffer.slice(e,C),l.repeat(" ",A)+h+m+g+`

11`+l.repeat(" ",A+this.position-e+h.length)+"^"},d.prototype.toString=function(A){var o,h="";return this.name&&(h+='in "'+this.name+'" '),h+="at line "+(this.line+1)+", column "+(this.column+1),A||(o=this.getSnippet(),o&&(h+=`:

12`+o)),h},Qr=d,Qr}var en,Ci;function Le(){if(Ci)return en;Ci=1;var l=rr(),d=["kind","resolve","construct","instanceOf","predicate","represent","defaultStyle","styleAliases"],A=["scalar","sequence","mapping"];function o(e){var g={};return e!==null&&Object.keys(e).forEach(function(C){e[C].forEach(function(m){g[String(m)]=C})}),g}function h(e,g){if(g=g||{},Object.keys(g).forEach(function(C){if(d.indexOf(C)===-1)throw new l('Unknown option "'+C+'" is met in definition of "'+e+'" YAML type.')}),this.tag=e,this.kind=g.kind||null,this.resolve=g.resolve||function(){return!0},this.construct=g.construct| ...

13\r`;function h(m){if(m===null)return!1;var S,E,Y=0,y=m.length,b=o;for(E=0;E<y;E++)if(S=b.indexOf(m.

14`:r===118?"\v":r===102?"\f":r===114?"\r":r===101?"\x1B":r===32?" ":r===34?'"':r===47?"/":r===92?"\\":r===78?"":r===95?" ":r===76?"\u2028":r===80?"\u2029":""}function Oe(r){return r<=65535?String.fromCharCode(r):String.fromCharCode((r-65536>>10)+55296,(r-65536&1023)+56320)}function Fe(r,$,j){$==="__proto__"?Object.defineProperty(r,$,{configurable:!0,enumerable:!0,writable:!0,value:j}):r[$]=j}for(var Ue=new Array(256),ye=new Array(256),Me=0;Me<256;Me++)Ue[Me]=Ee(Me)?1:0,ye[Me]=Ee(Me);function Ze(r,$){this.input=r,this.filename=$.filename||null,this.schema=$.schema||h,this.onWarning=$.onWarning| ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/packem_shared/docker-BYqiD711.jsView on unpkg · L12

15`,$-1))}function Je(r,$,j){var K,P,u,w,O,R,N,H,T=r.kind,z=r.result,G;if(G=r.input.charCodeAt(r.position),q(G)||ue(G)

16`,u?1+R:R):P===E&&u&&(r.result+=`

17`);break}for(K?te(T)?(N=!0,r.result+=l.repeat(`

18`,u?1+R:R)):N?(N=!1,r.result+=l.repeat(`

19`,R+1)):R===0?u&&(r.result+=" "):r.result+=l.repeat(`

20`,R):r.result+=l.repeat(`

21`,u?1+R:R),u=!0,w=!0,R=0,j=r.position;!Z(T)&&T!==0;)T=r.input.charCodeAt(++r.position);Re(r,j,r.position,!1)}return!0}function rt(r,$){var j,K=r.tag,P=r.anchor,u=[],w,O=!1,R;for(r.anchor!==null&&(r.anchorMap[r.anchor]=u),R=r.input.charCodeAt(r.position);R!==0&&!(R!==45||(w=r.input.charCodeAt(r.position+1),!q(w)));){if(O=!0,r.position++,U(r,!0,-1)&&r.lineIndent<=$){u.push(null),R=r.input.charCodeAt(r.position);continue}if(j=r.line,He(r,$,m,!1,!0),u.push(r.result),U(r,!0,-1),R=r.input.charCodeAt(r.position),(r.line===j||r.lineIndent>$)&&R!==0)ee(r,"bad indentation of a sequence entry");else if(r ...

22`),r.charCodeAt(0)===65279&&(r=r.slice(1)));var j=new Ze(r,$),K=r.indexOf("\0");for(K!==-1&&(j.position=K,ee(j,"null byte is not allowed in input")),j.input+="\0";j.input.charCodeAt

23`,R),N===-1?(T=u.slice(R),R=z):(T=u.slice(R,N+1),R=N+1),T.length&&T!==`

24`&&(H+=O),H+=T;return H}function De(u,w){return`

25`+l.repeat(" ",u.indent*w)}function Re(u,w){var O,R,N;for(O=0,R=u.implicitTypes.length;O<R;O+=1)if(N=u.implicitTypes[O],N.resolve(w))return!0;return!1}function qe(u){return u===S||u===g}function we(u){return 32<=u&&u<=126||161<=u&&u<=55295&&u!==8232&&u!==8233||57344<=u&&u<=65533&&u!==65279||65536<=u&&u<=1114111}function W(u){return we(u)&&!qe(u)&&u!==65279&&u!==m&&u!==C}function U(u,w){return we(u)&&u!==65279&&u!==ae&&u!==ge&&u!==Ae&&u!==Oe&&u!==Ue&&u!==Z&&(u!==y||w&&W(w))}function ie(u){return we(u)&&u!==65279&&!qe(u)&&u!==x&&u!==ue&&u!==Z&&u!==ae&&u!==ge&&u!==Ae&&u!==Oe&&u!==Ue&&u!==y&&u!==v ...

26`,N=R&&(u[u.length-2]===`

27`||u===`

28`),H=N?"+":R?"":"-";return O+H+`

29`}function ut(u){return u[u.length-1]===`

30`?u.slice(0,-1):u}function wt(u,w){for(var O=/(\n+)([^\n]*)/g,R=(function(){var ne=u.indexOf(`

31`);return ne=ne!==-1?ne:u.length,O.lastIndex=ne,He(u.slice(0,ne),w)})(),N=u[0]===`

32`||u[0]===" ",H,T;T=O.exec(u);){var z=T[1],G=T[2];H=G[0]===" ",R+=z+(!N&&!H&&G!==

Long lines were clipped for display.

dist/packem_chunks/cli-main.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/packem_chunks/cli-main.jsView on unpkg · L1

1import{createRequire as FC}from"node:module";import{d as WC,c as Lr,V as IC,h as _C,e as zC,r as KC}from"../packem_shared/index-jJNulo5i.js";import{T as ui,F as Gf,m as L,e as Jl,H... L2: `))}};const Pl=["bash","zsh","fish","powershell"],Nl=["node","bun","deno"],FY=e=>"Deno"in e,QY=e=>"Bun"in e,$p=()=>FY(globalThis)?"deno":QY(globalThis)?"bun":"node",Zp=e=>{const i=... L3: `);e.info(n)},UY={description:"Generate shell completion scripts",env:[{description:"Shell path (Unix-like systems). Used for shell detection.",name:"SHELL",type:String},{descripti... L4: `)),s}else{const r=["Failed to generate completion script",`Error: ${s instanceof Error?s.message:String(s)}`,"","Troubleshooting:"," • Ensure @bomb.sh/tab is installed: pnpm add ... L5: `))}}},name:"completion",options:[{defaultOption:!0,defaultValue:Zp(),description:"Shell type (bash, zsh, fish, powershell). Defaults to current shell if detected.",name:"shell",ty... L6: `);let n=0;for(;i[n]&&i[n].trim().match(/^(#|$)/);)n++;const o=i.length;let a=n+1;for(;a<o&&i[a].trim();)a++;return i.slice(n,a).join(" ").trim()}return jd}var mm={dependancies:"de... L7: ${o.join(`\r ... L262: \x1B[2mtip: ${t}\x1B[0m L263: `),n.lastGlobal

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/packem_chunks/cli-main.jsView on unpkg · L1

dist/packem_shared/env-DdQRnEIy.jsView file

Lines 1-21javascript

1import{createRequire as et}from"node:module";import{m as ii,a as dt,f as mu}from"./index-CE6MsgcV.js";import{a as rt}from"./readJsonSync-DuMMeB3s-ihoybKvs.js";const nt=et(import.meta.url),vo=typeof globalThis<"u"&&typeof globalThis.process<"u"?globalThis.process:process,Zo=i=>{if(typeof vo<"u"&&vo.versions&&vo.versions.node){const[o,e]=vo.versions.node.split(".").map(Number);if(o>22||o===22&&e>=3||o===20&&e>=16)return vo.getBuiltinModule(i)}return nt(i)},{existsSync:at,rmSync:wu,writeFileSync:ut,readdirSync:ju,statSync:gt}=Zo("node:fs"),{spawn:$n}=Zo("node:child_process"),{createHash:tt}=Zo("n ...

2`);for(const g of u){const d=g.trim();if(d)try{const h=JSON.parse(d.endsWith("}")?d:`${d}}`),s=`${h.namespace?`${h.namespace}/`:""}${h.name}`,l=`${s}@${h.version}`;if(!a.has(l))continue;const v=h.score.overall??Jt(h.score),r={alerts:h.alerts,author:h.author,id:h.id,license:h.license,name:h.name,score:{...h.score,overall:v},size:h.size,type:"npm",version:h.version};h.namespace&&(r.namespace=h.namespace),kt(r)&&(e.set(l,r),St(s,h.version,r,n))}catch{}}},Ht=i=>i.namespace?`${i.namespace}/${

3`)},Dt=()=>{const i=So();if(!mu(i))return 0;const o=ju(i).filter(e=>e.endsWith(".json"));for(const e of o)wu(ii(i,e),{force

4`),XX=(i,o={})=>{const e=Bt(i,o.minimumScore);if(e)return{clearCache:Dt,displayName:"Socket.dev",fetchReports:n=>Ct(n,e),getCacheStats:Tt,id:"socket"}},Mt=[161,161,164,164,167,168,170,170,173,174,176,180,182,186,188,191,198,198,208,208,215,216,222,225,230,230,232,234,236,237,240,240,242,243,247,250,252,252,254,254,257,257,273,273,275,275,283,283,294,295,299,299,305,307,312,312,319,322,324,324,328,331,333,333,338,339,358,359,363,363,462,462,464,464,466,466,468,468,470,470,472,472,474,474,476,476,593,593,609,609,708,708,711,711,713,715,717,717,720,720,728,731,733,733,735,735,768,879,913,929,931, ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/packem_shared/env-DdQRnEIy.jsView on unpkg · L1

5/* [wrapped with `+o+`] */

6`)}function on(i){return function(){return i}}var Ao=(function(){try{var i=zi(Object,"defineProperty");return i({},"",{}),i}catch{}})(),Ih=Ao?function(i,o){return Ao(i,"toString",{configurable:!0,enumerable:!1,value:on(o),writable:!0})}:oi,en=Ru(Ih);function ti(i,o){for(var e=-1,n=i==null?0:i.length;++e<n&&o(i[e],e,i)!==!1;);return i}function $o(i,o,e,n){for(var a=i.length,u=e+(n?1:-1);n?u--:++u<a;)if(o(i[u],u,i))return u;return-1}function _u(i){return i!==i}function Uh(i,o,e){for(var n=e-1,a=i.length;++n<a;)if(i[n]===o)return n;return-1}function ao(i,o,e){return o===o?Uh(i,o,e):$o(i,_u,e)}fun ...

7`:"";i.replace(r,function(p,w,j,Z,X,A){return j||(j=Z),v+=i.slice(s,A).replace(rY,eY),w&&(d=!0,v+=`' +

8__e(`+w+`) +

9'`),X&&(h=!0,v+=`';

10`+X+`;

11__p += '`),j&&(v+=`' +

12((__t = (`+j+`)) == null ? '' : __t) +

13'`),s=A+p.length,p}),v+=`';

14`;var y=hu.call(o,"variable")&&o.variable;if(!y)v=`with (obj) {

15`+v+`

16}

17`;else if(su.test(y))throw new Error(uY);v=(h?v.replace(dY,""):v).replace(tY,"$1").replace(sY,"$1;"),v="function("+(y||"obj")+

18`+(y?"":`obj || (obj = {});

19`)+"var __t, __p = ''"+(d?", __e = _.escape":"")+(h?`, __j = Array.prototype.join;

20function print() { __p += __j.call(arguments, '') }

21`:`;

Long lines were clipped for display.