128`)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Uc("endDumpTypes"),Bd("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Fe(fe){let qe=h;if(h++,h>=x)return ne(v.Unexpected_end_of_text),"";let ct=ae(...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
node_modules/@zuplo/core/customer.cli.minified.js:
`;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\\";case 78:return"\x85";ca...
`+new Array(m).join(" ")+"^"}}return null}t(igt,"getErrorSource");function _br(s){var a=igt(s),l=obr();l&&l._handle&&l._handle.setBlocking&&l._handle.setBlocking(!0),a&&(console.er...
`),r.closeSync(pe),Uc("endDumpTypes"),Bd("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
`)),o}t(J4,"getTextOfNodeFromSourceText"
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg 128`)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Uc("endDumpTypes"),Bd("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Fe(fe){let qe=h;if(h++,h>=x)return ne(v.Unexpected_end_of_text),"";let ct=ae(...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 24Cross-file remote execution chain: node_modules/@zuplo/core/customer.cli.minified.js spawns node_modules/@zuplo/core/index.minified.js; helper contains network access plus dynamic code execution.
L24:
L25: // Needed because of https://github.com/evanw/esbuild/issues/1944
L26: import { fileURLToPath } from 'node:url';
...
L30: const __filename = fileURLToPath(import.meta.url);
L31: const __dirname = dirname(__filename);
L32:
L33: var cZt=Object.create;var eH=Object.defineProperty;var lZt=Object.getOwnPropertyDescriptor;var uZt=Object.getOwnPropertyNames;var fZt=Object.getPrototypeOf,_Zt=Object.prototype.has...
L34: `):l+=m;return l}t(Lit,"highlight");var Nit=!1,Iit=/\r\n|[\n\r\u2028\u2029]/;function KZt(s,a,l,_){let m=Object.assign({column:0,line:-1},s.start),b=Object.assign({},m,s.end),{
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L24 128Trigger-reachable command-output exfiltration chain: manifest.bin -> zup.js -> dist/cli.js -> dist/cmds/build.js -> dist/build/handler.js -> node_modules/@zuplo/core/customer.cli.minified.js
L128: `)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Uc("endDumpTypes"),Bd("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Fe(fe){let qe=h;if(h++,h>=x)return ne(v.Unexpected_end_of_text),"";let ct=ae(...
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128