aegiscode@5.2.20: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

aegiscode@5.2.20: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-node-version.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/cli.jsView file

173. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("require... L19: `+oI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=$dI("")),c+=SLI(t);else if(h===` L26: `){let r=[...t];jLI(Z.slice(N+1),r),c+=KLI(r),e&&(c+=$dI(e))}N+=h.length}return c}});import tr from"node:process";import{execFileSync as _LI}from"node:child_process";import ug from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

3L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("requi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> bin/cli.js L3: L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransit

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.jsView on unpkg · L3

25`)e&&(c+=$dI("")),c+=SLI(t);else if(h===` L26: `){let r=[...t];jLI(Z.slice(N+1),r),c+=KLI(r),e&&(c+=$dI(e))}N+=h.length}return c}});import tr from"node:process";import{execFileSync as _LI}from"node:child_process";import ug from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L25

173. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("require... L19: `+oI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=$dI("")),c+=SLI(t);else if(h===` L26: `){let r=[...t];jLI(Z.slice(N+1),r),c+=KLI(r),e&&(c+=$dI(e))}N+=h.length}return c}});import tr from"node:process";import{execFileSync as _LI}from"node:child_process";import ug from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cli.jsView on unpkg · L17

3L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("requi

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L3

3L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("requi

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

bin/cli.jsView on unpkg · L3

3Trigger-reachable credential exfiltration chain: manifest.bin -> bin/cli.js L3: L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}fun

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

bin/cli.jsView on unpkg · L3

17Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/cli.js L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("require... L19: `+oI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=$dI("")),c+=SLI(t);else if(h===` L26: `){let r=[...t];jLI(Z.slice(N+1),r),c+=KLI(r),e&&(c+=$dI(e))}N+=h.length}return c}});import tr from"node:process";import{execFileSync as _LI}from"node:child_process";import ug from... L27: at`)?" (<anonymous>)":-1<i.sta

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cli.jsView on unpkg · L17

3Trigger-reachable persistence chain: manifest.bin -> bin/cli.js L3: L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/cli.jsView on unpkg · L3

3L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("requi

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/cli.jsView on unpkg · L3

•path = bin/cli.js kind = oversized_source_file sizeBytes = 8151924 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

bin/cli.jsView on unpkg

•path = bin/cli.js kind = oversized_cli_entrypoint sizeBytes = 8151924 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/cli.jsView on unpkg

scripts/release-local.shView file

•path = scripts/release-local.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-local.shView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "aegiscode",

3 "version": "5.2.20",

4 "description": "AEGIS CLI — AI-powered coding assistant",

5 "type": "module",

6 "bin": {

7 "aegis": "bin/cli.js",

8 "aegis-cli": "bin/cli.js",

9 "aegiscli": "bin/cli.js",

10 "aegiscode": "bin/cli.js"

11 },

12 "scripts": {

13 "preinstall": "node scripts/ensure-node-version.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "build": "node esbuild.mjs",

15 "build:publish": "npm run build && node scripts/make-bin.mjs",

16 "dev": "NODE_NO_WARNINGS=1 tsx src/main.tsx",

17 "start": "node --no-deprecation dist/main.js",

18 "typecheck": "tsc --noEmit",

19 "test:prompts": "tsx src/prompts/test.ts",

20 "test:tools": "tsx src/tools/test.ts",

21 "test:pipeline": "tsx src/tools/execution/test.ts",

22 "test:context": "tsx src/context/test.ts",

23 "test:mcp": "tsx src/mcp/test.ts",

24 "test:store": "tsx src/store/test.ts"

25 },

26 "keywords": [

27 "cli",

28 "ai",

29 "coding-agent",

30 "llm",

31 "openai",

32 "gpt",

33 "claude",

bin/cli.jsView file

173. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("require... L19: `+oI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=$dI("")),c+=SLI(t);else if(h===` L26: `){let r=[...t];jLI(Z.slice(N+1),r),c+=KLI(r),e&&(c+=$dI(e))}N+=h.length}return c}});import tr from"node:process";import{execFileSync as _LI}from"node:child_process";import ug from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

3L4: var OJI=Object.create;var UU=Object.defineProperty;var MJI=Object.getOwnPropertyDescriptor;var jJI=Object.getOwnPropertyNames;var SJI=Object.getPrototypeOf,KJI=Object.prototype.has... L5: `);let c;for(;(c=I5I.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function G5I(l){l=l||{};let I=yaI(l);l.path=I;let G=Wn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function T(){_.asyncTransitions--}function j(z){if(pc===null)try{var uI=("requi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L3

scripts/release-local.shView file

•path = scripts/release-local.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-local.shView on unpkg