•matchType = previous_version_dangerous_delta
matchedPackage = aicommits@4.0.1
matchedIdentity = npm:YWljb21taXRz:4.0.1
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli-18Yz--RL.mjsView on unpkg 1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo...
L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])...
HighChild Process
Package source references child process execution.
dist/cli-18Yz--RL.mjsView on unpkg · L1 21`);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);...
L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"v"),Ke(Ns,"mapParametersToArguments");function Zd(e){return e===void 0||e!==!1}i(Zd,"G$2"),Ke(Zd,"helpEnabled");function Qi(e,t,n,o){const r={....
L23: `:10,n=typeof e=="string"?"\r":13;return e[e.length-1]===t&&(e=e.slice(0,-1)),e[e.length-1]===n&&(e=e.slice(0,-1)),e}i(db,"stripFinalNewline");function sp(e={}){const{env:t=process...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli-18Yz--RL.mjsView on unpkg · L21 11`))}return n.join(`
L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len...
L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object....
L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description}
...
L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);...
L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli-18Yz--RL.mjsView on unpkg · L11 1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo...
L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])...
...
L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len...
L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object....
L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersi
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/cli-18Yz--RL.mjsView on unpkg · L1 11Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.mjs -> dist/cli-18Yz--RL.mjs
L11: `))}return n.join(`
L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len...
L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object....
L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description}
...
L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/cli-18Yz--RL.mjsView on unpkg · L11 176`,{prompt:o,stopSequences:[`
L177: ${t}:`]}}i(O3,"[redacted]");function Lg({id:e,model:t,created:n}){return{id:e??void 0,modelId:t??void 0,timestamp:n!=null?new Date(n*1e3):void 0}}i(L...
L178: ${C.message}`),b?new l.VercelOidcTokenError(b):C}return h}i(d,"getVercelOidcToken");function f(){const m=(0,c.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OID...
MediumDynamic Require
Package source references dynamic require/import behavior.
dist/cli-18Yz--RL.mjsView on unpkg · L176