registry / blade-code / 0.11.7

blade-code@0.11.7

⚠ Under review

🗡️ Blade Code - 智能代码助手命令行工具

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 4.38 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, code.visualstudio.com, duckduckgo.com, example.com, gateway.example.com, github.com, glama.ai, mcp.exa.ai, r.jina.ai, raw.githubusercontent.com, react.dev, registry.npmjs.org, search.ononoki.org, searx.be, searx.tiekoetter.com, searx.work, tauri.localhost, www.npmjs.com, www.w3.org

Source & flagged code

12 flagged

dist/chunk-d561qcwy.jsView file

Lines 1-21javascript

1import{Ae as O1,Be as n2,Ce as d2,De as J1,Ee as Q1,Fe as i2,Ge as Y1,He as V0,Ie as Z1,Je as G1,Le as r2,Se as o2,Te as Q0,_e as I_,af as V1,cf as a2,df as t2,ef as L1,ff as s2,ue as l2,ve as e,we as p2,xe as W1,ye as c2,ze as v}from"./chunk-s14zayxp.js";import{xg as h_}from"./chunk-pm163dfm.js";import{sh as l_}from"./chunk-1cy4ab77.js";import{Zi as f1}from"./chunk-b22ab7yw.js";import{Aj as E_,wj as u2,xj as h2,yj as F_,zj as r_}from"./chunk-m2x6pb4f.js";import{Ej as $0}from"./chunk-saz6mwpq.js";import{Rj as P_,Uj as u_}from"./chunk-0eajnhrj.js";import{Xj as __}from"./chunk-k17d0ysy.js";impor ...

2`,"utf8"),!0}catch(W){if(A_(W,"EEXIST"))return!1;if($)await $_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class X_ extends Error{code="BLADE_SESSION_IN_USE";constructor(_){super(_?`Session is already active in another Blade process (PID ${_}). Stop that process or choose a different session.`:"Session is already active in another Blade process. Stop that process or choose a different session.");this.name="SessionInUseError"}}async function b1(_,X,$=!1){let W,J;try{J=await L4.lock(_,{realpath:!1,retries:$?{retries:50,minTimeout:10,maxTimeout:100,factor:1 ...

High

Child Process

Package source references child process execution.

dist/chunk-d561qcwy.jsView on unpkg · L1

4...[middle omitted; read the private prompt artifact for the complete request]...

6`;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function k_(_,X){let $=_ instanceof

7`),Z=P1(_);return{content:E4(J,Z,W.contentLayout,F_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async restore(_,X){let $=x0(X);if(!$&&w0(X))throw Error("Prompt artifact reference is invalid");if(!$)return _;let W;try{W=await this.readVerified($.id,$.sizeBytes)}catch(V){throw k_(V,"Prompt artifact is unavailable or invalid")}let J=W.toString("utf8");if(J.length!==$.textChars)throw Error("Prompt artifact character count does not match its reference");let O=P1(_);if(!$.contentLayout){if(O.length>0)throw Error("Prompt artifact content layout is missing");return J}let ...

8`));return{version:R0,id:W,sha256:W,sizeBytes:_.length,textChars:X,inlineBytes:F_-O,...$?{contentLayout:$}:{}}}async verify(_,X){await this.readVerified(_,X)}async

9`)}function _2(_,X){return{reviewId:_.reviewId,phase:"completed",status:X.status,target:{kind:_.target.kind,label:_.target.label,..._.target.baseSha?{reference:_.target.baseSha}:{},..._.target.commitSha?{reference:_.target.commitSha}:{}},overallExplanation:X.overallExplanation,findings:X.findings.map(($)=>({title:$.title,body:$.body,priority:$.priority,confidenceScore:$.confidenceScore,codeLocation:{...$.codeLocation}})),...X.error?{error:X.error}:{}}}var u0=1;var m0=2000,f4='<token-budget-handoff version="1">',CW="handoff-message-",j4=128,y4=["version","messageId","observedPromptTokens","avai ...

10`)}function v4(_){let X=$2(_);if(new TextEncoder().encode(X).length>m0)throw Error(`Token budget handoff reminder exceeds ${m0} bytes`);return

11... (display clipped) ...

12`,W=_.indexOf(`

13`),J=W>=0&&/^(?:stdout|stderr):$/.test(_.slice(0,W))?`${_.slice(0,W)}

14`:"",O=J?_.slice(J.length):_,Q=X-J.length-$.length;if(Q<=0)return G2(_,X);let Y=Math.min(Math.floor(Q/3),O.length),Z=Math.max(0,Q-Y);return J+r0(O,Y)+$+G2(O,Z)}function t4(_){let X=_.split(`

15`),$=X.at(-1);if(!$?.startsWith("Output truncated"))return{body:_};return{body:X.slice(0,-1).join(`

16`),suffix:$}}function s4(_){let $=_.indexOf(`

17stderr:

18`);if(!_.startsWith(`stdout:

19`)||$<0)return[_];return[_.slice(0,$),_.slice($+1)]}function vW(_,X){if(!Number.isSafeInteger(X)||X<=0)throw Error("maxChars must be a positive safe integer");if(!_.detail||_.detail.length<=X)return _;let{body:$,suffix:W}=t4(_.detail),J=W?`

20${r0(W,X)}`:"",O=Math.max(0,X-J.length),Q=s4($),Y;if(Q.length===2){let L=Math.max(0,O-1),G=Math.floor(L/2),B=L-G;Y=`${i0(Q[0],G)}

21${i0(Q[1],B)}`}else Y=i0($,O);let Z=r0(`${Y}${J}`,X);return{..._,detail:Z}}function o0(_){let X=_.metadata;return X!==null&&typeof X==="object"&&"conversationRecap"in X&&X.conversationRecap===!0}import{createHash as e4}from"node:crypto";import U2 from"node:path";var O0=16777216,B2=65536,nW=1048576,_X=8,J0=200,XX=/(?:^|[_-])(?:api[_-]?key|authorization|bearer|cookie|credential|password|passwd|private[_-]?key|refresh[_-]?token|secret|session[_-]?token|token)(?:$|[_-])/i,$X=/(?<![:/A-Za-z0-9._-])\/[^\s"'`<>]+/g,WX=/(?<![A-Za-z0-

Long lines were clipped for display.

dist/chunk-253fwyzb.jsView file

Lines 1-15javascript

1import{e as B3,f as x3,g as f3,h as r0,i as S3}from"./chunk-33sgdacd.js";import{j as o1}from"./chunk-870szc6v.js";import{w as t0,x as d2,y as

dist/chunk-hdbxph08.jsView file

Lines 1-3javascript

1import{Xj as I}from"./chunk-k17d0ysy.js";import{Jk as f}from"./chunk-gmpsfkgg.js";import*as j from"fs/promises";import*as S from"path";import X from

dist/chunk-4mamvx8a.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blade-code@0.10.189 matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.189 similarity = 0.357 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-4mamvx8a.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-4mamvx8a.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){p0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,J=0,Z=0,Y=0;for(let Q of this.readAll()){if(T4(Q.ownerPid)&&S4... [error] ${K.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(Z,z);try{await W.release()}catch(K){throw z.status="aborted",z.endTime=Date.now(),await H... `):o$(Z,Math.max(0,X))}${u8}`,truncated:!0}}class d8{latestByPage=new Map;issue($){let J=LH($.snapshot,$.maxBytes),Z={snapshotId:`browser_snapshot_${_J()}`,pageId:$.pageId,pageGene... `).filter((q)=>q.toLocaleLowerCase("en-US").includes(B)),D=K.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-4mamvx8a.jsView on unpkg

vendor/ripgrep/linux-arm64/rgView file

•path = vendor/ripgrep/linux-arm64/rg kind = native_binary sizeBytes = 4466000 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/linux-arm64/rgView on unpkg

dist/chunk-crv3sghv.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-crv3sghv.jsView on unpkg

dist/chunk-nad5spvc.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-nad5spvc.jsView on unpkg

dist/chunk-n90wq61v.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-n90wq61v.jsView on unpkg

blade-code@0.11.7

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code