@zubriq/code@0.19.8-1: Suspicious npm security report (Warn)

Loading npm security reports…

@zubriq/code@0.19.8-1: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/chunks/chunk-ABANKQYY.js sets OPENAI_BASE_URL to https://api.zubriq.by/v1 whenever OPENAI_API_KEY exists and no base URL is set.
dist/chunks/chunk-ABANKQYY.js copies ZUBRIQ_API_KEY into OPENAI_API_KEY at runtime for provider requests.
dist/chunks/startInteractiveUI-SUSZ6FWB.js implements a browser auth flow that receives a token on a local callback.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
scripts/cli-entry.js only resolves dist/cli.js and imports/spawns it for user-invoked CLI commands.
dist/chunks/chunk-PDITONOB.js declares ZubrIQ as a package-aligned OpenAI-compatible provider with envKey ZUBRIQ_API_KEY.
Native ripgrep and tree-sitter WASM artifacts are expected bundled tooling for a code assistant/search/parser package.
tree-sitter-bash-RPMGROCZ.js high-entropy blob is an embedded tree-sitter WASM parser, not a decoded secret.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 609 file(s), 38.9 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, aiplatform.googleapis.com, api.anthropic.com, api.dingtalk.com, api.github.com, api.openai.com, api.sgroup.qq.com, api.telegram.org, api.zubriq.by, bots.qq.com, bucket.example.com, cdn.example.com, cdn.jsdelivr.net, chat.qwen.ai, chevrotain.io, claudemarketplaces.com, cloud.google.com, cloudresourcemanager.googleapis.com, code.zubriq.by, codeload.github.com, coding-intl.dashscope.aliyuncs.com, coding.dashscope.aliyuncs.com, console.zubriq.by, crystal-lang.org, dashscope.aliyuncs.com, dev.w3.org, developer.mozilla.org, docs.anthropic.com, docs.expo.dev, docs.microsoft.com, docs.neo4j.org, dotenvx.com, dummy.com, empty.invalid, en.cppreference.com, en.wikipedia.org, example.com, fb.me, fburl.com, fetch.spec.whatwg.org, fishshell.com, geminicli.com, generativelanguage.googleapis.com, gist.githubusercontent.com, git.new, github.com, help.openai.com, host.docker.internal

Oversized source lightweight scan

dist/chunks/chunk-PDITONOB.js5.32 MB file, sampled 256 KB

FilesystemNetworkChildProcessEvalCryptoHighEntropyStringsUrlStringsgithub.com

dist/chunks/chunk-YRM6BC6H.js2.75 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringswww.apache.org

dist/chunks/dist-LPVU3L2M.js4.70 MB file, sampled 256 KB

FilesystemNetworkChildProcessCryptoHighEntropyStringsUrlStringsopen.feishu.cn

Source & flagged code

17 flagged

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-22IFUCVR.jsView file

Lines 23-63javascript

23 }

24 if (process.env["CI"] || process.env["DEBIAN_FRONTEND"] === "noninteractive") {

25 return false;

26 }

27 const isSSH = !!process.env["SSH_CONNECTION"];

28 if (process.platform === "linux") {

29 const displayVariables = ["DISPLAY", "WAYLAND_DISPLAY", "MIR_SOCKET"];

30 const hasDisplay = displayVariables.some((v) => !!process.env[v]);

31 if (!hasDisplay) {

32 return false;

33 }

34 }

35 if (isSSH && process.platform !== "linux") {

36 return false;

37 }

38 return true;

39}

40__name(shouldAttemptBrowserLaunch, "shouldAttemptBrowserLaunch");

42// packages/core/src/utils/secure-browser-launcher.ts

43init_esbuild_shims();

44import { execFile, spawn } from "node:child_process";

45import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L43

46import { platform } from "node:os";

47import { resolve } from "node:path";

48import { URL, fileURLToPath } from "node:url";

49var execFileAsync = promisify(execFile);

50function validateUrl(url, { allowFile = false, allowedFilePaths } = {}) {

51 let parsedUrl;

52 try {

53 parsedUrl = new URL(url);

54 } catch (_error) {

55 throw new Error(`Invalid URL: ${url}`);

56 }

57 const allowedProtocols = allowFile ? ["http:", "https:", "file:"] : ["http:", "https:"];

58 if (!allowedProtocols.includes(parsedUrl.protocol)) {

59 throw new Error(

60 `Unsafe protocol: ${parsedUrl.protocol}. Only ${allowedProtocols.join(

61 ", "

62 )} are allowed.`

63 );

Lines 91-131javascript

91 } catch (_error) {

92 console.warn(

93 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

94 _error

95 )}. Falling back to the platform browser opener.`

96 );

97 }

98 }

dist/chunks/chunk-RFIL6REB.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-RFIL6REB.jsView on unpkg · L279

dist/chunks/chunk-4UC3U66K.jsView file

Lines 265-305javascript

265 return false;

266 }

267 stream.write(sequence, (err) => {

268 if (err) debugLogger.warn("writeOsc52: async write failed:", err);

269 });

dist/chunks/chunk-DHKDK57Q.jsView file

121isValidEditorType, L122: resolveBaseUrl, L123: resolveMetadataKey, ... L7062: import path from "node:path"; L7063: import { spawn, spawnSync } from "node:child_process"; L7064: var CACHE_LIMIT = 40; ... L12487: const currentText = stateRef.current.lines.join("\n"); L12488: fs2.writeFileSync(filePath, currentText, { L12489: encoding: "utf8",

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L121

1825var err = new Error( L1826: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1827: ); ... L1936: } L1937: if (process.platform === "win32") { L1938: const osRelease = os3.release().split("."); ... L1983: supportsColor: getSupportLevel, L1984: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1985: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4841: function wrapAnsi(string, columns, options) { L4842: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L4843: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L1825

dist/chunks/chunk-3RW4AZJV.jsView file

Lines 232-272javascript

232 if (/[.']-+[.']/.test(ts)) {

233 return "";

234 }

235 if (ts.trim().length

dist/web-shell/assets/index-tiCo0xbZ.jsView file

48Error generating stack: `+s.message+` L49: `+s.stack}}var C4=Object.prototype.hasOwnProperty,$k=Lr.unstable_scheduleCallback,L2=Lr.unstable_cancelCallback,$q=Lr.unstable_shouldYield,zq=Lr.unstable_requestPaint,So=Lr.unstabl... L50: `).replace(MH,"")}function cR(e,t){return t=W7(t),W7(e)===t}function bs(e,t,n,s,r,i){switch(n){case"children":typeof s=="string"?t==="body"||t==="textarea"&&s===""||df(e,s):(typeof... ... L60: `);if(r!==-1){let i=n+r;t.push(e.slice(n,i)),n=i+4}else t.push(e.slice(n,s)),n=s+2}return{frames:t,tail:e.slice(n)}}function fw(e){if(!e)return;let t=[];for(let s of e.split(/\r?\n... L61: `);try{let s=JSON.parse(n);if(typeof s!="object"||s===null||Array.isArray(s)||s.v!==1||typeof s.type!="string")return;let r=s.id;return r!==void 0&&(!Number.isSafeInteger(r)||r<1)?.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/web-shell/assets/index-tiCo0xbZ.jsView on unpkg · L48

dist/chunks/chunk-55ZMG67I.jsView file

3import { L4: import_websocket L5: } from "./chunk-H6BD2ELD.js"; ... L23: } L24: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L25: this._timeouts = timeouts; ... L422: L423: // node_modules/gaxios/package.json L424: var require_package = __commonJS({ ... L749: return; L750: } else if (obj instanceof FormData || obj instanceof URLSearchParams || // support `node-fetch` FormData/URLSearchParams L751: "forEach" in obj && "set" in obj) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/chunk-55ZMG67I.jsView on unpkg · L3

dist/chunks/chunk-PDITONOB.jsView file

•context = emPayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs8.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs8.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs8.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs8.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Gets

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-PDITONOB.jsView on unpkg

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView file

191Cross-file remote execution chain: dist/chunks/startInteractiveUI-SUSZ6FWB.js spawns dist/chunks/chunk-UE5TCZE6.js; helper contains network access plus dynamic code execution. L191: use_stdin_default, L192: use_stdout_default L193: } from "./chunk-UE5TCZE6.js"; ... L630: exports.unsafe = unsafe; L631: var eol = typeof process !== "undefined" && process.platform === "win32" ? "\r\n" : "\n"; L632: function encode(obj, opt) { ... L706: case "null": L707: value = JSON.parse(value); L708: } ... L895: var env3 = exports.env = function(prefix, env4) { L896: env4 = env4 || process.env; L897: var obj = {};

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView on unpkg · L191

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/chunks/chunk-YRM6BC6H.jsView file

•path = dist/chunks/chunk-YRM6BC6H.js kind = oversized_source_file sizeBytes = 2882672 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-YRM6BC6H.jsView on unpkg

Source & flagged code

17 flagged · loading source

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-22IFUCVR.jsView file

43init_esbuild_shims(); L44: import { execFile, spawn } from "node:child_process"; L45: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L43

111case "win32": L112: command = "powershell.exe"; L113: args = [

High

Shell

Package source references shell execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L111

dist/chunks/chunk-RFIL6REB.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-RFIL6REB.jsView on unpkg · L279

dist/chunks/chunk-4UC3U66K.jsView file

285const modName = "@teddyzhu/clipboard"; L286: cachedClipboardModule = await import(modName); L287: return cachedClipboardModule;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-4UC3U66K.jsView on unpkg · L285

dist/chunks/chunk-DHKDK57Q.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L121

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L1825

dist/chunks/chunk-3RW4AZJV.jsView file

252function getWindowWidth() { L253: if (typeof process === "object" && process.stdout && process.stdout.columns) { L254: return process.stdout.columns; ... L1336: var _c; L1337: var minNodeVersion = process && process.env && process.env.YARGS_MIN_NODE_VERSION ? Number(process.env.YARGS_MIN_NODE_VERSION) : 12; L1338: var nodeVersion = (_b = (_a = process === null || process === void 0 ? void 0 : process.versions) === null || _a === void 0 ? void 0 : _a.node) !== null && _b !== void 0 ? _b : (_c... ... L1341: if (major < minNodeVersion) { L1342: throw Error(`yargs parser supports a minimum Node.js version of ${minNodeVersion}. Read our version support policy: https://github.com/yargs/yargs-parser#supported-nodejs-versions`... L1343: } ... L1359: } else if (path.match(/\.json$/)) { L1360:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunks/chunk-3RW4AZJV.jsView on unpkg · L252

dist/web-shell/assets/index-tiCo0xbZ.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/web-shell/assets/index-tiCo0xbZ.jsView on unpkg · L48

dist/chunks/chunk-55ZMG67I.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/chunk-55ZMG67I.jsView on unpkg · L3

dist/chunks/chunk-PDITONOB.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-PDITONOB.jsView on unpkg

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView on unpkg · L191

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/chunks/chunk-YRM6BC6H.jsView file

•path = dist/chunks/chunk-YRM6BC6H.js kind = oversized_source_file sizeBytes = 2882672 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-YRM6BC6H.jsView on unpkg

Source & flagged code

17 flagged

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-22IFUCVR.jsView file

Lines 23-63javascript

23 }

24 if (process.env["CI"] || process.env["DEBIAN_FRONTEND"] === "noninteractive") {

25 return false;

26 }

27 const isSSH = !!process.env["SSH_CONNECTION"];

28 if (process.platform === "linux") {

29 const displayVariables = ["DISPLAY", "WAYLAND_DISPLAY", "MIR_SOCKET"];

30 const hasDisplay = displayVariables.some((v) => !!process.env[v]);

31 if (!hasDisplay) {

32 return false;

33 }

34 }

35 if (isSSH && process.platform !== "linux") {

36 return false;

37 }

38 return true;

39}

40__name(shouldAttemptBrowserLaunch, "shouldAttemptBrowserLaunch");

42// packages/core/src/utils/secure-browser-launcher.ts

43init_esbuild_shims();

44import { execFile, spawn } from "node:child_process";

45import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L43

46import { platform } from "node:os";

47import { resolve } from "node:path";

48import { URL, fileURLToPath } from "node:url";

49var execFileAsync = promisify(execFile);

50function validateUrl(url, { allowFile = false, allowedFilePaths } = {}) {

51 let parsedUrl;

52 try {

53 parsedUrl = new URL(url);

54 } catch (_error) {

55 throw new Error(`Invalid URL: ${url}`);

56 }

57 const allowedProtocols = allowFile ? ["http:", "https:", "file:"] : ["http:", "https:"];

58 if (!allowedProtocols.includes(parsedUrl.protocol)) {

59 throw new Error(

60 `Unsafe protocol: ${parsedUrl.protocol}. Only ${allowedProtocols.join(

61 ", "

62 )} are allowed.`

63 );

Lines 91-131javascript

91 } catch (_error) {

92 console.warn(

93 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

94 _error

95 )}. Falling back to the platform browser opener.`

96 );

97 }

98 }

dist/chunks/chunk-RFIL6REB.jsView file

279site.name = fn.name; L280: var deprecatedfn = new Function( L281: "fn",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunks/chunk-RFIL6REB.jsView on unpkg · L279

dist/chunks/chunk-4UC3U66K.jsView file

Lines 265-305javascript

265 return false;

266 }

267 stream.write(sequence, (err) => {

268 if (err) debugLogger.warn("writeOsc52: async write failed:", err);

269 });

dist/chunks/chunk-DHKDK57Q.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L121

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-DHKDK57Q.jsView on unpkg · L1825

dist/chunks/chunk-3RW4AZJV.jsView file

Lines 232-272javascript

232 if (/[.']-+[.']/.test(ts)) {

233 return "";

234 }

235 if (ts.trim().length

dist/web-shell/assets/index-tiCo0xbZ.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/web-shell/assets/index-tiCo0xbZ.jsView on unpkg · L48

dist/chunks/chunk-55ZMG67I.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/chunk-55ZMG67I.jsView on unpkg · L3

dist/chunks/chunk-PDITONOB.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-PDITONOB.jsView on unpkg

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/startInteractiveUI-SUSZ6FWB.jsView on unpkg · L191

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/chunks/chunk-YRM6BC6H.jsView file

•path = dist/chunks/chunk-YRM6BC6H.js kind = oversized_source_file sizeBytes = 2882672 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-YRM6BC6H.jsView on unpkg

@zubriq/code@0.19.8-1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code