128`)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Bc("endDumpTypes"),Md("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Oe(fe){let qe=h;if(h++,h>=x)return re(v.Unexpected_end_of_text),"";let ct=ae(...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
node_modules/@zuplo/core/customer.cli.minified.js:
`;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\\";case 78:return"\x85";ca...
`+new Array(m).join(" ")+"^"}}return null}t(Lht,"getErrorSource");function kvr(s){var a=Lht(s),u=Tvr();u&&u._handle&&u._handle.setBlocking&&u._handle.setBlocking(!0),a&&(console.er...
`),r.closeSync(pe),Bc("endDumpTypes"),Md("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
`)),o}t(L4,"getTextOfNodeFromSourceText"
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg 128`)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Bc("endDumpTypes"),Md("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Oe(fe){let qe=h;if(h++,h>=x)return re(v.Unexpected_end_of_text),"";let ct=ae(...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128 24Cross-file remote execution chain: node_modules/@zuplo/core/customer.cli.minified.js spawns node_modules/@zuplo/core/index.minified.js; helper contains network access plus dynamic code execution.
L24:
L25: // Needed because of https://github.com/evanw/esbuild/issues/1944
L26: import { fileURLToPath } from 'node:url';
...
L30: const __filename = fileURLToPath(import.meta.url);
L31: const __dirname = dirname(__filename);
L32:
L33: var UXt=Object.create;var YV=Object.defineProperty;var $Xt=Object.getOwnPropertyDescriptor;var zXt=Object.getOwnPropertyNames;var JXt=Object.getPrototypeOf,qXt=Object.prototype.has...
L34: `):u+=m;return u}t(Tit,"highlight");var git=!1,yit=/\r\n|[\n\r\u2028\u2029]/;function wZt(s,a,u,_){let m=Object.assign({column:0,line:-1},s.start),b=Object.assign({},m,s.end),{
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L24 128Trigger-reachable command-output exfiltration chain: manifest.bin -> zup.js -> dist/cli.js -> dist/cmds/build.js -> dist/build/handler.js -> node_modules/@zuplo/core/customer.cli.minified.js
L128: `)}r.writeSync(pe,`]
L129: `),r.closeSync(pe),Bc("endDumpTypes"),Md("Dump types","beginDumpTypes","endDumpTypes")}t(te,"dumpTypes");function ae(){p&&r.writeFileSync(p,JSON.stringify(g))}t(ae,"dumpLegend"),e....
L130: `,ct=h;continue}h++}return R.assert(Ut!==void 0),P=ht,Ut}t(oe,"scanTemplateAndSetTokenValue");function Oe(fe){let qe=h;if(h++,h>=x)return re(v.Unexpected_end_of_text),"";let ct=ae(...
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
node_modules/@zuplo/core/customer.cli.minified.jsView on unpkg · L128