128`)}r.writeSync(_e,`]
L129: `),r.closeSync(_e),Ic("endDumpTypes"),Dd("Dump types","beginDumpTypes","endDumpTypes")}t(Q,"dumpTypes");function ne(){_&&r.writeFileSync(_,JSON.stringify(h))}t(ne,"dumpLegend"),e.d...
L130: `,ct=m;continue}m++}return F.assert(Bt!==void 0),P=mt,Bt}t(se,"scanTemplateAndSetTokenValue");function Ne(ue){let Je=m;if(m++,m>=T)return ee(v.Unexpected_end_of_text),"";let ct=ne(...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
node_modules/@zuplo/core/customer.cli.minified.js:
`;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\\";case 78:return"\x85";ca...
`+new Array(y).join(" ")+"^"}}return null}t(mpt,"getErrorSource");function Emr(s){var o=mpt(s),f=vmr();f&&f._handle&&f._handle.setBlocking&&f._handle.setBlocking(!0),o&&(console.er...
`),r.closeSync(_e),Ic("endDumpTypes"),Dd("Dump types","beginDumpTypes","endDumpTypes")}t(Q,"dumpTypes");function ne(){_&&r.writeFileSync(_,JSON.stringify(h))}t(ne,"dumpLegend"),e.d...
`)),a}t(p4,"getTextOfNodeFromSourceText"
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg 128`)}r.writeSync(_e,`]
L129: `),r.closeSync(_e),Ic("endDumpTypes"),Dd("Dump types","beginDumpTypes","endDumpTypes")}t(Q,"dumpTypes");function ne(){_&&r.writeFileSync(_,JSON.stringify(h))}t(ne,"dumpLegend"),e.d...
L130: `,ct=m;continue}m++}return F.assert(Bt!==void 0),P=mt,Bt}t(se,"scanTemplateAndSetTokenValue");function Ne(ue){let Je=m;if(m++,m>=T)return ee(v.Unexpected_end_of_text),"";let ct=ne(...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 24Cross-file remote execution chain: node_modules/@zuplo/core/customer.cli.minified.js spawns node_modules/@zuplo/core/index.minified.js; helper contains network access plus dynamic code execution.
L24:
L25: // Needed because of https://github.com/evanw/esbuild/issues/1944
L26: import { fileURLToPath } from 'node:url';
...
L30: const __filename = fileURLToPath(import.meta.url);
L31: const __dirname = dirname(__filename);
L32:
L33: var bGt=Object.create;var aV=Object.defineProperty;var SGt=Object.getOwnPropertyDescriptor;var TGt=Object.getOwnPropertyNames;var xGt=Object.getPrototypeOf,EGt=Object.prototype.has...
L34: `):f+=y;return f}t(Frt,"highlight");var Prt=!1,Art=/\r\n|[\n\r\u2028\u2029]/;function aYt(s,o,f,d){let y=Object.assign({column:0,line:-1},s.start),x=Object.assign({},y,s.end),{
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L24 128Trigger-reachable command-output exfiltration chain: manifest.bin -> zup.js -> dist/cli.js -> dist/cmds/build.js -> dist/build/handler.js -> node_modules/@zuplo/core/customer.cli.minified.js
L128: `)}r.writeSync(_e,`]
L129: `),r.closeSync(_e),Ic("endDumpTypes"),Dd("Dump types","beginDumpTypes","endDumpTypes")}t(Q,"dumpTypes");function ne(){_&&r.writeFileSync(_,JSON.stringify(h))}t(ne,"dumpLegend"),e.d...
L130: `,ct=m;continue}m++}return F.assert(Bt!==void 0),P=mt,Bt}t(se,"scanTemplateAndSetTokenValue");function Ne(ue){let Je=m;if(m++,m>=T)return ee(v.Unexpected_end_of_text),"";let ct=ne(...
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128