aegiscode@5.2.24: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

19 flagged

package.jsonView file

Lines 1-33json

2 "name": "aegiscode",

3 "version": "5.2.24",

4 "description": "AEGIS CLI — AI-powered coding assistant",

5 "type": "module",

6 "bin": {

7 "aegis": "bin/cli.js",

8 "aegis-cli": "bin/cli.js",

9 "aegiscli": "bin/cli.js",

10 "aegiscode": "bin/cli.js"

11 },

12 "scripts": {

13 "preinstall": "node scripts/ensure-node-version.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "build": "node esbuild.mjs",

15 "build:publish": "npm run build && node scripts/make-bin.mjs",

16 "dev": "NODE_NO_WARNINGS=1 tsx src/main.tsx",

17 "start": "node --no-deprecation dist/main.js",

18 "typecheck": "tsc --noEmit",

19 "test:prompts": "tsx src/prompts/test.ts",

20 "test:tools": "tsx src/tools/test.ts",

21 "test:pipeline": "tsx src/tools/execution/test.ts",

22 "test:context": "tsx src/context/test.ts",

23 "test:mcp": "tsx src/mcp/test.ts",

24 "test:store": "tsx src/store/test.ts"

25 },

26 "keywords": [

27 "cli",

28 "ai",

29 "coding-agent",

30 "llm",

31 "openai",

32 "gpt",

33 "claude",

bin/cli.jsView file

173. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransitions--}function j(z){if(iG===null)try{var WI=("requir... L19: `+uI.replace(/^Error(:[^\n]*)?\n/,""))});return tI.prototype=Object.create(U.prototype),tI.prototype.constructor=tI,tI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=GdI("")),c+=u4I(t);else if(h===` L26: `){let r=[...t];N4I(Z.slice(N+1),r),c+=h4I(r),e&&(c+=GdI(e))}N+=h.length}return c}});import LY from"node:process";import{execFileSync as V4I}from"node:child_process";import Av from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

3L4: var WCI=Object.create;var BB=Object.defineProperty;var oCI=Object.getOwnPropertyDescriptor;var NCI=Object.getOwnPropertyNames;var uCI=Object.getPrototypeOf,hCI=Object.prototype.has... L5: `);let c;for(;(c=FCI.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function XCI(l){l=l||{};let I=JnI(l);l.path=I;let G=tn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransitions--}function j(z){if(iG===null)try{var WI=("requ

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L3

scripts/release-local.shView file

•path = scripts/release-local.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-local.shView on unpkg

scripts/install-alacritty.shView file

•matchType = normalized_sha256 matchedPackage = aegiscode@5.2.20 matchedPath = scripts/install-alacritty.sh matchedIdentity = npm:YWVnaXNjb2Rl:5.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-alacritty.shView on unpkg

scripts/install.shView file

•matchType = normalized_sha256 matchedPackage = aegiscode@5.2.20 matchedPath = scripts/install.sh matchedIdentity = npm:YWVnaXNjb2Rl:5.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.shView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-node-version.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

aegiscode@5.2.24: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

19 flagged

package.jsonView file

Lines 1-33json

2 "name": "aegiscode",

3 "version": "5.2.24",

4 "description": "AEGIS CLI — AI-powered coding assistant",

5 "type": "module",

6 "bin": {

7 "aegis": "bin/cli.js",

8 "aegis-cli": "bin/cli.js",

9 "aegiscli": "bin/cli.js",

10 "aegiscode": "bin/cli.js"

11 },

12 "scripts": {

13 "preinstall": "node scripts/ensure-node-version.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "build": "node esbuild.mjs",

15 "build:publish": "npm run build && node scripts/make-bin.mjs",

16 "dev": "NODE_NO_WARNINGS=1 tsx src/main.tsx",

17 "start": "node --no-deprecation dist/main.js",

18 "typecheck": "tsc --noEmit",

19 "test:prompts": "tsx src/prompts/test.ts",

20 "test:tools": "tsx src/tools/test.ts",

21 "test:pipeline": "tsx src/tools/execution/test.ts",

22 "test:context": "tsx src/context/test.ts",

23 "test:mcp": "tsx src/mcp/test.ts",

24 "test:store": "tsx src/store/test.ts"

25 },

26 "keywords": [

27 "cli",

28 "ai",

29 "coding-agent",

30 "llm",

31 "openai",

32 "gpt",

33 "claude",

bin/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L3

scripts/release-local.shView file

•path = scripts/release-local.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-local.shView on unpkg

scripts/install-alacritty.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-alacritty.shView on unpkg

scripts/install.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.shView on unpkg

aegiscode@5.2.24

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code