@zubriq/code@0.22.3-1: Suspicious npm security report (Warn)

Loading npm security reports…

@zubriq/code@0.22.3-1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged

dist/chunks/chunk-MFHQXTFN.jsView file

2301init_esbuild_shims(); L2302: import * as childProcess from "node:child_process"; L2303: var debugLogger = createDebugLogger("GIT");

High

Child Process

Package source references child process execution.

dist/chunks/chunk-MFHQXTFN.jsView on unpkg · L2301

dist/chunks/chunk-JWALNCLT.jsView file

Lines 1013-1053javascript

1013 cachedBashPath = bashPath;

1014 return bashPath;

1015 } catch {

1016 }

1017 }

1018 cachedBashPath = "bash";

1019 return "bash";

1020}

1021__name(findGitBashPath, "findGitBashPath");

1022function getShellConfiguration() {

1023 if (isWindows()) {

1024 const msystem = process.env["MSYSTEM"];

1025 const term = process.env["TERM"] || "";

1026 const isGitBash = msystem?.startsWith("MINGW") || msystem?.startsWith("MSYS") || term.includes("msys") || term.includes("cygwin");

1027 if (isGitBash) {

1028 return {

1029 executable: findGitBashPath(),

1030 argsPrefix: ["-c"],

1031 shell: "bash"

1032 };

1033 }

1034 const comSpec = process.env["ComSpec"] || "cmd.exe";

1035 const executable = comSpec.toLowerCase();

High

Shell

Package source references shell execution.

dist/chunks/chunk-JWALNCLT.jsView on unpkg · L1033

1036 if (executable.endsWith("powershell.exe") || executable.endsWith("pwsh.exe")) {

1037 return {

1038 executable: comSpec,

1039 argsPrefix: ["-NoProfile", "-Command"],

1040 shell: "powershell"

1041 };

1042 }

1043 return {

1044 executable: comSpec,

1045 argsPrefix: ["/d", "/s", "/c"],

1046 shell: "cmd"

1047 };

1048 }

1049 return { executable: "bash", argsPrefix: ["-c"], shell: "bash" };

1050}

1051__name(getShellConfiguration, "getShellConfiguration");

1052var isWindows = /* @__PURE__ */ __name(() => os.platform() === "win32", "isWindows");

1053function escapeShellArg(arg, shell) {

dist/web-shell/assets/index-CGT341lL.jsView file

52`+g.message)}var n=new it;n.add(a),n.isGeoSVGGraphicRoot=!0;var i=e.width,o=e.height,s=e.viewBoxRect,l=this._boundingRect;if(!l){var u=void 0,f=void 0,v=void 0,h=void 0;if(i!=null?... L53: `+i.message)}return f8(e,n),A(n,function(i){var o=i.name;h8(e,i),p8(e,i);var s=this._specialAreas&&this._specialAreas[o];s&&i.transformTo(s.left,s.top,s.width,s.height)},this),n},r... L54: `))}),t.join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web-shell/assets/index-CGT341lL.jsView on unpkg · L52

dist/chunks/chunk-JS5NN4TW.jsView file

Lines 86-126javascript

86 return pathToFileURL(path.join(extensionPath, entry)).href;

87}

88__name(resolveExtensionChannelEntrySpecifier, "resolveExtensionChannelEntrySpecifier");

89async function loadChannelsFromExtensions() {

90 let loaded

dist/chunks/dist-SWQMYP2Q.jsView file

Lines 1-23javascript

1// Force strict mode and setup for ESM

2"use strict";

3import {

4 require_axios,

5 require_ws

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-SWQMYP2Q.jsView on unpkg · L3

6} from "./chunk-AVNATYLY.js";

7import

dist/chunks/run-qwen-serve-HM4CCO2G.jsView file

Lines 38-78javascript

38 positiveFiniteOrNull,

39 prepareManagedScratchRoot,

40 resolveAcpHttpEnabled,

41 toDaemonStatusMemoryLimits

42} from "./chunk-4NDLQAY2.js";

43import {

44 ConversationDirectoryIdentityError,

45 assertExactConversationRootIdentity,

46 createConversationRootIdentity,

dist/chunks/chunk-PRXI6UCZ.jsView file

Lines 1-39javascript

1// Force strict mode and setup for ESM

2"use strict";

3import {

4 isGitRepository

5} from "./chunk-SMPR7SPO.js";

6import {

7 createDebugLogger

8} from "./chunk-UHQFIS7N.js"

dist/chunks/chunk-AMDSOFFV.jsView file

Lines 83-123javascript

83 if (target !== copy) {

84 if (deep && copy && (isPlainObject(copy) || (copyIsArray = isArray(copy)))) {

85 if (copyIsArray) {

dist/chunks/chunk-4UNTZ2KJ.jsView file

•context = (interactionMode);\n const basePrompt = systemMdEnabled ? fs4.readFileSync(systemMdPath, "utf8") : buildDefaultBasePrompt(interaction, model, effectiveOutputStyle);\n const writeSystemMdResolution = resolvePathFromEnv(\n process2.env["QWEN_WRITE_SYSTEM_MD"]\n );\n if (writeSystemMdResolution.value && !writeSystemMdResolution.isDisabled) {\n const writePath = writeSystemMdResolution.isSwitch ? systemMdPath : writeSystemMdResolution.value;\n fs4.mkdirSync(path4.dirname(writePath), { recursive: true });\n fs4.writeFileSync(\n writePath,\n systemMdEnabled ? basePrompt : buildDefaultBasePrompt(interaction, model, void 0)\n );\n }\n return assembleSystemPrompt({\n base: systemMdEnabled ? basePrompt : applyOutputStyle(basePrompt, effectiveOutputStyle),\

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-4UNTZ2KJ.jsView on unpkg

dist/chunks/chunk-KJ34CWMB.jsView file

330init_esbuild_shims(); L331: var exec = __require("child_process").exec; L332: var execSync = __require("child_process").execSync; ... L734: }; L735: function findModelConfig(modelProviders, providerProtocol, authType, modelId, baseUrl) { L736: if (!modelProviders || !modelId) { ... L1294: try { L1295: writeFileSync(path3, data, { encoding: "utf8", flag: "wx" }); L1296: } catch (error) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-KJ34CWMB.jsView on unpkg · L330

dist/chunks/chunk-3I6VWVN3.jsView file

304Cross-file remote execution chain: dist/chunks/chunk-3I6VWVN3.js spawns dist/chunks/chunk-4UNTZ2KJ.js; helper contains network access plus dynamic code execution. L304: init_esbuild_shims(); L305: import { spawn } from "node:child_process"; L306: ... L477: let wlCopyError; L478: const run = /* @__PURE__ */ __name((cmd, args, options) => new Promise((resolve4, reject) => { L479: const child = options ? spawn(cmd, args, options) : spawn(cmd, args); L480: let stderr = ""; L481: if (child.stderr) { ... L495: child.stdin.on("error", reject); L496: child.stdin.write(text); L497: child.stdin.end(); ... L502: const linuxOptions = { stdio: ["pipe", "inherit", "pipe"] };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-3I6VWVN3.jsView on unpkg · L304

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/chunks/dist-GFN5DCBX.jsView file

•path = dist/chunks/dist-GFN5DCBX.js kind = oversized_source_file sizeBytes = 5782589 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-GFN5DCBX.jsView on unpkg

dist/chunks/chunk-3JXM2CVW.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/chunk-3JXM2CVW.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/chunks/chunk-MFHQXTFN.jsView file

2301init_esbuild_shims(); L2302: import * as childProcess from "node:child_process"; L2303: var debugLogger = createDebugLogger("GIT");

High

Child Process

Package source references child process execution.

dist/chunks/chunk-MFHQXTFN.jsView on unpkg · L2301

dist/chunks/chunk-JWALNCLT.jsView file

1033} L1034: const comSpec = process.env["ComSpec"] || "cmd.exe"; L1035: const executable = comSpec.toLowerCase();

High

Shell

Package source references shell execution.

dist/chunks/chunk-JWALNCLT.jsView on unpkg · L1033

dist/web-shell/assets/index-CGT341lL.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web-shell/assets/index-CGT341lL.jsView on unpkg · L52

dist/chunks/chunk-JS5NN4TW.jsView file

106try { L107: const module = await import(entrySpecifier); L108: const plugin = module.plugin;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-JS5NN4TW.jsView on unpkg · L106

dist/chunks/dist-SWQMYP2Q.jsView file

3import { L4: require_axios, L5: require_ws ... L313: this.logger.info("File downloaded successfully"); L314: return { buffer: Buffer.from(response.data), filename }; L315: } catch (error) { ... L449: * L450: * 格式：{ cmd: "aibot_subscribe", headers: { req_id }, body: { secret, bot_id } } L451: */ ... L1548: import { isIP } from "node:net"; L1549: import { lookup } from "node:dns/promises"; L1550: var ClientCtor = import_aibot_node_sdk.WSClient;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-SWQMYP2Q.jsView on unpkg · L3

dist/chunks/run-qwen-serve-HM4CCO2G.jsView file

58import { L59: formatMemoryBudgetStderr, L60: resolveDaemonMemoryBudget, ... L143: EXTERNAL_TOOL_GUARD_TOKEN_ENV, L144: PRIVATE_EXTERNAL_TOOL_GUARD_ENV, L145: PRIVATE_EXTERNAL_TOOL_GUARD_PROVIDER_ENV ... L211: import { X509Certificate, createHash as createHash2, timingSafeEqual } from "node:crypto"; L212: import { execFile } from "node:child_process"; L213: import * as fs from "node:fs"; L214: import { createServer } from "node:http"; L215: import * as https from "node:https"; ... L497: function getRuntimeBaseDir(runtimeOutputDir, cwd) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/run-qwen-serve-HM4CCO2G.jsView on unpkg · L58

dist/chunks/chunk-PRXI6UCZ.jsView file

19import * as path from "node:path"; L20: import * as childProcess from "node:child_process"; L21: import { promisify } from "node:util"; ... L34: })(PackageManager || {}); L35: function getNpmCliPath(nodePath = process.execPath, platform = process.platform) { L36: if (platform === "win32") { ... L64: var debugLogger = createDebugLogger("INSTALLATION_INFO"); L65: var STANDALONE_UNIX_INSTALLER = "https://code.zubriq.by/install.sh"; L66: var STANDALONE_WINDOWS_INSTALLER = "https://code.zubriq.by/install.ps1"; ... L113: try { L114: const { stdout } = await run( L115: "brew",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunks/chunk-PRXI6UCZ.jsView on unpkg · L19

dist/chunks/chunk-AMDSOFFV.jsView file

103L104: // node_modules/gaxios/package.json L105: var require_package = __commonJS({ ... L397: case "json": L398: return JSON.parse(JSON.stringify(data)); L399: case "arraybuffer": ... L430: return; L431: } else if (obj instanceof FormData || obj instanceof URLSearchParams || // support `node-fetch` FormData/URLSearchParams L432: "forEach" in obj && "set" in obj) { ... L792: const noProxyList = [...noProxy]; L793: const noProxyEnvList = (process.env.NO_PROXY ?? process.env.no_proxy)?.split(",") || []; L794: for (const rule of noProxyEnvList) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunks/chunk-AMDSOFFV.jsView on unpkg · L103

dist/chunks/chunk-4UNTZ2KJ.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-4UNTZ2KJ.jsView on unpkg

dist/chunks/chunk-KJ34CWMB.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-KJ34CWMB.jsView on unpkg · L330

dist/chunks/chunk-3I6VWVN3.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-3I6VWVN3.jsView on unpkg · L304

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/chunks/dist-GFN5DCBX.jsView file

•path = dist/chunks/dist-GFN5DCBX.js kind = oversized_source_file sizeBytes = 5782589 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-GFN5DCBX.jsView on unpkg

dist/chunks/chunk-3JXM2CVW.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/chunk-3JXM2CVW.jsView on unpkg

Source & flagged code

15 flagged

dist/chunks/chunk-MFHQXTFN.jsView file

2301init_esbuild_shims(); L2302: import * as childProcess from "node:child_process"; L2303: var debugLogger = createDebugLogger("GIT");

High

Child Process

Package source references child process execution.

dist/chunks/chunk-MFHQXTFN.jsView on unpkg · L2301

dist/chunks/chunk-JWALNCLT.jsView file

Lines 1013-1053javascript

1013 cachedBashPath = bashPath;

1014 return bashPath;

1015 } catch {

1016 }

1017 }

1018 cachedBashPath = "bash";

1019 return "bash";

1020}

1021__name(findGitBashPath, "findGitBashPath");

1022function getShellConfiguration() {

1023 if (isWindows()) {

1024 const msystem = process.env["MSYSTEM"];

1025 const term = process.env["TERM"] || "";

1026 const isGitBash = msystem?.startsWith("MINGW") || msystem?.startsWith("MSYS") || term.includes("msys") || term.includes("cygwin");

1027 if (isGitBash) {

1028 return {

1029 executable: findGitBashPath(),

1030 argsPrefix: ["-c"],

1031 shell: "bash"

1032 };

1033 }

1034 const comSpec = process.env["ComSpec"] || "cmd.exe";

1035 const executable = comSpec.toLowerCase();

High

Shell

Package source references shell execution.

dist/chunks/chunk-JWALNCLT.jsView on unpkg · L1033

1036 if (executable.endsWith("powershell.exe") || executable.endsWith("pwsh.exe")) {

1037 return {

1038 executable: comSpec,

1039 argsPrefix: ["-NoProfile", "-Command"],

1040 shell: "powershell"

1041 };

1042 }

1043 return {

1044 executable: comSpec,

1045 argsPrefix: ["/d", "/s", "/c"],

1046 shell: "cmd"

1047 };

1048 }

1049 return { executable: "bash", argsPrefix: ["-c"], shell: "bash" };

1050}

1051__name(getShellConfiguration, "getShellConfiguration");

1052var isWindows = /* @__PURE__ */ __name(() => os.platform() === "win32", "isWindows");

1053function escapeShellArg(arg, shell) {

dist/web-shell/assets/index-CGT341lL.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web-shell/assets/index-CGT341lL.jsView on unpkg · L52

dist/chunks/chunk-JS5NN4TW.jsView file

Lines 86-126javascript

86 return pathToFileURL(path.join(extensionPath, entry)).href;

87}

88__name(resolveExtensionChannelEntrySpecifier, "resolveExtensionChannelEntrySpecifier");

89async function loadChannelsFromExtensions() {

90 let loaded

dist/chunks/dist-SWQMYP2Q.jsView file

Lines 1-23javascript

1// Force strict mode and setup for ESM

2"use strict";

3import {

4 require_axios,

5 require_ws

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/dist-SWQMYP2Q.jsView on unpkg · L3

6} from "./chunk-AVNATYLY.js";

7import

dist/chunks/run-qwen-serve-HM4CCO2G.jsView file

Lines 38-78javascript

38 positiveFiniteOrNull,

39 prepareManagedScratchRoot,

40 resolveAcpHttpEnabled,

41 toDaemonStatusMemoryLimits

42} from "./chunk-4NDLQAY2.js";

43import {

44 ConversationDirectoryIdentityError,

45 assertExactConversationRootIdentity,

46 createConversationRootIdentity,

dist/chunks/chunk-PRXI6UCZ.jsView file

Lines 1-39javascript

1// Force strict mode and setup for ESM

2"use strict";

3import {

4 isGitRepository

5} from "./chunk-SMPR7SPO.js";

6import {

7 createDebugLogger

8} from "./chunk-UHQFIS7N.js"

dist/chunks/chunk-AMDSOFFV.jsView file

Lines 83-123javascript

83 if (target !== copy) {

84 if (deep && copy && (isPlainObject(copy) || (copyIsArray = isArray(copy)))) {

85 if (copyIsArray) {

dist/chunks/chunk-4UNTZ2KJ.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-4UNTZ2KJ.jsView on unpkg

dist/chunks/chunk-KJ34CWMB.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-KJ34CWMB.jsView on unpkg · L330

dist/chunks/chunk-3I6VWVN3.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-3I6VWVN3.jsView on unpkg · L304

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/chunks/dist-GFN5DCBX.jsView file

•path = dist/chunks/dist-GFN5DCBX.js kind = oversized_source_file sizeBytes = 5782589 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-GFN5DCBX.jsView on unpkg

dist/chunks/chunk-3JXM2CVW.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunks/chunk-3JXM2CVW.jsView on unpkg

@zubriq/code@0.22.3-1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code