•matchType = previous_version_dangerous_delta
matchedPackage = @weppy/roblox-mcp@2.17.1
matchedIdentity = npm:QHdlcHB5L3JvYmxveC1tY3A:2.17.1
similarity = 0.613
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg 104\r
L105: `+r)}function ml(t,e,r,n,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ml),t.emit("wsClientError",o,r,e)}else Wh(r,n,i,a)}});import IQ from...
L106: `)){if(/^\s*#/.test(e))continue;let r=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(r)return r.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var AQ=ee(...
104\r
L105: `+r)}function ml(t,e,r,n,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,ml),t.emit("wsClientError",o,r,e)}else Wh(r,n,i,a)}});import IQ from...
L106: `)){if(/^\s*#/.test(e))continue;let r=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(r)return r.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var AQ=ee(...
2import { createRequire as __bundleCreateRequire } from 'module';const require = __bundleCreateRequire(import.meta.url);
L3: var Bee=Object.create;var BC=Object.defineProperty;var Vee=Object.getOwnPropertyDescriptor;var Wee=Object.getOwnPropertyNames;var Hee=Object.getPrototypeOf,Zee=Object.prototype.has...
L4: `:""},this._extScope=e,this._scope=new gi.Scope({parent:e}),this._nodes=[new OE]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu...
...
L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,le._)`+${i}`);return;case"boolean":n.elseIf((0,le._)`${i} === "false" || ${i} === 0 || ${i} === null`)....
L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,le._)`[${i}]`)}}}function fse({gen:t,parentData:e,p
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L2 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var Bee=Object.create;var BC=Object.defineProperty;var Vee=Object.getOwnPropertyDescriptor;var Wee=Object.getOwnPropertyNames;var Hee=Object.getPrototypeOf,Zee=Object.prototype.has...
`}f5.exports=Gve;function Gve(t,e,r){var n=r||{},i=n.env||process.env.NODE_ENV||"development",a=n.onerror;return function(o){var s,c,l;if(!o&&d5(e)){h1("cannot 404 after headers se...
`;t.dashboardSseClients?.forEach(i=>{i.write(n)})}function $3(t,e){t.dashboardSseClients??=new Set,t.dashboardSseClients.add(e);let r=t.watchSubscriptionHub?.addDashboardSubscriber...
${" ".repeat(e)}}`}throw new TypeError(`Unsupported canonical JSON value: $
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 3var Bee=Object.create;var BC=Object.defineProperty;var Vee=Object.getOwnPropertyDescriptor;var Wee=Object.getOwnPropertyNames;var Hee=Object.getPrototypeOf,Zee=Object.prototype.has...
L4: `:""},this._extScope=e,this._scope=new gi.Scope({parent:e}),this._nodes=[new OE]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu...
L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,le._)`+${i}`);return;case"integer":n.elseIf((0,le._)`${o} === "boolean" || ${i} === null
L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,le._)`+${i}`);return;case"boolean":n.elseIf((0,le._)`${i} === "false" || ${i} === 0 || ${i} === null`)....
L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,le._)`[${i}]`)}}}function
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L3 3Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js
L3: var Bee=Object.create;var BC=Object.defineProperty;var Vee=Object.getOwnPropertyDescriptor;var Wee=Object.getOwnPropertyNames;var Hee=Object.getPrototypeOf,Zee=Object.prototype.has...
L4: `:""},this._extScope=e,this._scope=new gi.Scope({parent:e}),this._nodes=[new OE]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu...
L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,le._)`+${i}`);return;case"integer":n.elseIf((0,le._)`${o} === "boolean" || ${i} === null
L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,le._)`+${i}`);return;case"boolean":n.elseIf((0,le._)`${i} === "false" || ${i} === 0 || ${i} === null`)...
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/index.jsView on unpkg · L3 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg 6|| (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,le._)`+${i}`);return;case"boolean":n.elseIf((0,le._)`${i} === "false" || ${i} === 0 || ${i} === null`)....
L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,le._)`[${i}]`)}}}function fse({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,le._)`${e} !== undefined`,()=>t.assign((0,le...
L8: missingProperty: ${n},
LowEval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L6 2import { createRequire as __bundleCreateRequire } from 'module';const require = __bundleCreateRequire(import.meta.url);
L3: var Bee=Object.create;var BC=Object.defineProperty;var Vee=Object.getOwnPropertyDescriptor;var Wee=Object.getOwnPropertyNames;var Hee=Object.getPrototypeOf,Zee=Object.prototype.has...
L4: `:""},this._extScope=e,this._scope=new gi.Scope({parent:e}),this._nodes=[new OE]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu...
L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,le._)`+${i}`);return;case"integer":n.elseIf((0,le._)`${o} === "boolean" || ${i} === null
L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,le._)`+${i}`);return;case"boolean":n.elseIf((0,le._)`${i} === "fa
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L2