aicommits@4.2.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

aicommits@4.2.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/cli-DTf2Slvu.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicommits@4.0.1 matchedIdentity = npm:YWljb21taXRz:4.0.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-DTf2Slvu.mjsView on unpkg

1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo... L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])...

High

Child Process

Package source references child process execution.

dist/cli-DTf2Slvu.mjsView on unpkg · L1

21`);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);... L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"v"),Ke(Ns,"mapParametersToArguments");function Zd(e){return e===void 0||e!==!1}i(Zd,"G$2"),Ke(Zd,"helpEnabled");function Qi(e,t,n,o){const r={.... L23: `:10,n=typeof e=="string"?"\r":13;return e[e.length-1]===t&&(e=e.slice(0,-1)),e[e.length-1]===n&&(e=e.slice(0,-1)),e}i(db,"stripFinalNewline");function sp(e={}){const{env:t=process...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli-DTf2Slvu.mjsView on unpkg · L21

11`))}return n.join(` L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description} ... L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);... L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli-DTf2Slvu.mjsView on unpkg · L11

1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo... L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])... ... L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersi

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-DTf2Slvu.mjsView on unpkg · L1

11Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.mjs -> dist/cli-DTf2Slvu.mjs L11: `))}return n.join(` L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description} ... L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli-DTf2Slvu.mjsView on unpkg · L11

176`,{prompt:o,stopSequences:[` L177: ${t}:`]}}i(O3,"[redacted]");function Lg({id:e,model:t,created:n}){return{id:e??void 0,modelId:t??void 0,timestamp:n!=null?new Date(n*1e3):void 0}}i(L... L178: ${C.message}`),b?new l.VercelOidcTokenError(b):C}return h}i(d,"getVercelOidcToken");function f(){const m=(0,c.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OID...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-DTf2Slvu.mjsView on unpkg · L176

Source & flagged code

7 flagged

dist/cli-DTf2Slvu.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicommits@4.0.1 matchedIdentity = npm:YWljb21taXRz:4.0.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-DTf2Slvu.mjsView on unpkg

1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo... L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])...

High

Child Process

Package source references child process execution.

dist/cli-DTf2Slvu.mjsView on unpkg · L1

21`);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);... L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"v"),Ke(Ns,"mapParametersToArguments");function Zd(e){return e===void 0||e!==!1}i(Zd,"G$2"),Ke(Zd,"helpEnabled");function Qi(e,t,n,o){const r={.... L23: `:10,n=typeof e=="string"?"\r":13;return e[e.length-1]===t&&(e=e.slice(0,-1)),e[e.length-1]===n&&(e=e.slice(0,-1)),e}i(db,"stripFinalNewline");function sp(e={}){const{env:t=process...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli-DTf2Slvu.mjsView on unpkg · L21

11`))}return n.join(` L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description} ... L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error(`Invalid node type: ${JSON.stringify(t)}`)}},i(Br,"_z"),Br);... L22: `),o(),process.exit(1);e[c]=l}}i(Ns,"

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli-DTf2Slvu.mjsView on unpkg · L11

1var E_=Object.defineProperty;var i=(e,t)=>E_(e,"name",{value:t,configurable:!0});var Br,zo,Pr,Nr,jr,zr,Ur,qr,Lr,Zr,Vr,uo,Gr,Hr,Wr,Jr,Uo,qo,Lo,Kr,Zo,Yr,Vo,Go,Ho,Xr,Wo,Jo,Ko,Yo,Qr,Xo... L2: `).map(t=>Qn(t))),"getLongestLineWidth"),d0=Ee(e=>{const t=[];for(const n of e){const{length:o}=n,r=o-t.length;for(let s=0;s<r;s+=1)t.push(0);for(let s=0;s<o;s+=1){const a=yd(n[s])... ... L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersi

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-DTf2Slvu.mjsView on unpkg · L1

11Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.mjs -> dist/cli-DTf2Slvu.mjs L11: `))}return n.join(` L12: `)},"renderRow"),F0=Ee((e,t)=>{if(!e||e.length===0)return"";const n=d0(e),o=n.length;if(o===0)return"";const{stdoutColumns:r,columns:s}=s0(t);if(s.length>o)throw new Error(`${s.len... L13: `)},"terminalColumns"),x0=["<",">","=",">=","<="],I0=Ee(e=>{if(!x0.includes(e))throw new TypeError(`Invalid breakpoint operator: ${e}`)},"assertOperator"),T0=Ee(e=>{const t=Object.... L14: `}}i(Bd,"k$2"),Ke(Bd,"getNameAndVersion");function Pd(e){const{help:t}=e;if(!(!t||!t.description))return{id:"description",type:"text",data:`${t.description} ... L21: `);if("type"in t&&this[t.type]){const n=this[t.type];if(typeof n=="function")return n.call(this,t.data)}throw new Error

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli-DTf2Slvu.mjsView on unpkg · L11

176`,{prompt:o,stopSequences:[` L177: ${t}:`]}}i(O3,"[redacted]");function Lg({id:e,model:t,created:n}){return{id:e??void 0,modelId:t??void 0,timestamp:n!=null?new Date(n*1e3):void 0}}i(L... L178: ${C.message}`),b?new l.VercelOidcTokenError(b):C}return h}i(d,"getVercelOidcToken");function f(){const m=(0,c.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OID...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-DTf2Slvu.mjsView on unpkg · L176