blade-code@0.10.130: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

blade-code@0.10.130: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/chunk-qahz5x5c.jsView file

6`,Buffer.byteLength($)}class Z1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function C$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map((J)=>({type:"image_url",image_url:{url:J.content}}));if(Q.length===0)return O;let Z... L8: `),$=await this.runCommand("osascript",["-e",O]);if(M4($))throw Error("Unable to open the macOS folder picker");return L4($.stdout)}async pickOnWindows(){let O=["Add-Type -Assembly...

High

Child Process

Package source references child process execution.

dist/chunk-qahz5x5c.jsView on unpkg · L6

1import{e as i2,f as c2,g as Y3,h as l0,i as N3}from"./chunk-t4apxzp1.js";import{j as u1}from"./chunk-grhsv55v.js";import{v as p0,w as w2}from"./chunk-xa9k5pjt.js";import{A as E0,x ... L2: `;if(O.event!==void 0)$+=`event: ${O.event} ... L6: `,Buffer.byteLength($)}class Z1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function C$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map((J)=>({type:"image_url",image_url:{url:J.content}}));if(Q.length===0)return O;let Z... L8: `),$=await this.runCommand("osascript",["-e",O]);if(M4($))throw Error("Unable to open the macOS folder picker");return L4($.stdout)}async pickOnWindows(){let O=["Add-Type -Assembly

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-qahz5x5c.jsView on unpkg · L1

1import{e as i2,f as c2,g as Y3,h as l0,i as N3}from"./chunk-t4apxzp1.js";import{j as u1}from"./chunk-grhsv55v.js";import{v as p0,w as w2}from"./chunk-xa9k5pjt.js";import{A as E0,x ... L2: `;if(O.event!==void 0)$+=`event: ${O.event} L3: `;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q} L4: `;if(O.retry!==void 0)$+=`retry: ${O.retry} L5: `;return $+=` L6: `,Buffer.byteLength($)}class Z1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function C$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map((J)=>({type:"image_url",image_url:{url:J.content}}));if(Q.length===0)return O;let Z... L8: `),$=await this.runCommand("osascript",["-e",O]);if(M4($)

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-qahz5x5c.jsView on unpkg · L1

dist/chunk-gfbkrk60.jsView file

18`).length>_.maxLines||T.length>_.maxChars}static getStats(T){return{lines:T.split(` L19: `).length,chars:T.length,words:T.split(/\s+/).filter(Boolean).length}}}var BT=32768,y$=1048576,h$=65536,P$=3600000,gT=4096,m$=/[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[-a-... L20: `):O.stderr,stdoutOmittedBytes:g.omittedBytes,stderrOmittedBytes:H.omittedBytes,binaryOutput:g.binary||H.binary,truncated:Boolean(O.truncationInfo)||g.omittedBytes>0||H.omittedByte...

High

Shell

Package source references shell execution.

dist/chunk-gfbkrk60.jsView on unpkg · L18

dist/chunk-v94ztjtp.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-v94ztjtp.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){p0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(b6(Q.ownerPid)&&A6... [error] ${G.message}`),H.releaseAdmission(),H.resolveCompletion()})()}),this.processes.set(J,H);try{await U.release()}catch(G){throw H.status="aborted",H.endTime=Date.now(),await W... `):r$(J,Math.max(0,X))}${k8}`,truncated:!0}}class x8{latestByPage=new Map;issue($){let Z=AV($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${e9()}`,pageId:$.pageId,pageGene... `).filter((q)=>q.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-v94ztjtp.jsView on unpkg

1import{Da as m9}from"./chunk-6p6ts4kv.js";import{Ga as T,Ha as t0,Ma as SX,Na as WY,Oa as o0}from"./chunk-tw5fr07c.js";import{Pa as a8,Ra as wU,Ta as FU,Ua as V9,kb as _U}from"./ch... L2: const { spawn } = require('node:child_process'); L3: const [ownerPidValue, command, ...args] = process.argv.slice(1); ... L11: if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1) return false; L12: if (process.platform !== 'win32' && process.ppid !== ownerPid) return false; L13: try { ... L79: } else if (ownerIsRunning()) { L80: child.stdin.end(); L81: } else { ... L97: child = spawn(command, args, { L98: env: process.env, L99: stdio: ['pipe', 'inherit', 'inherit'],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-v94ztjtp.jsView on unpkg · L1

dist/chunk-p2sp2e0a.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/blade.js -> dist/chunk-1bb4h5gf.js -> dist/chunk-p2sp2e0a.js L1: import{Cj as S}from"./chunk-v5hzk7j2.js";import{rk as f}from"./chunk-zkzhm39s.js";import*as $ from"fs/promises";import*as K from"path";import j from"semver";import{ProxyAgent as H,... L2: export{_ as k,u as l,g as m,C as n,V as o};

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-p2sp2e0a.jsView on unpkg · L1

dist/chunk-b8m7zc7t.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blade-code@0.10.41 matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.41 similarity = 0.384 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-b8m7zc7t.jsView on unpkg

Source & flagged code

8 flagged

dist/chunk-qahz5x5c.jsView file

Lines 1-15javascript

1import{e as i2,f as c2,g as Y3,h as l0,i as N3}from"./chunk-t4apxzp1.js";import{j as u1}from"./chunk-grhsv55v.js";import{v as p0,w as w2}from"./chunk-xa9k5pjt.js";import{A as E0,x as H2,y as B2,z as D2}from"./chunk-5a17mdjd.js";import{B as z2,C as O$,D as $$,E as Q$,F as $0,G as Z$}from"./chunk-9yqadjea.js";import{$ as w0,Ba as H3,J as $2,K as k1,L as w3,O as Q2,P as c0,Q as S4,R as y1,S as T$,T as K4,U as J2,V as J0,W as Y2,X as N2,Y as Y$,Z as Y1,_ as F4,aa as q0,da as x1,ea as L1,fa as q3,ga as X2,ha as V2,ia as q2,ja as E2,ka as S2,la as C2,ma as f2,na as P2,oa as k2,pa as m2,qa as h2,ta a ...

2`;if(O.event!==void 0)$+=`event: ${O.event}

3`;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q}

4`;if(O.retry!==void 0)$+=`retry: ${O.retry}

5`;return $+=`

6`,Buffer.byteLength($)}class Z1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendingBytes;constructor(O){this.maxPendingItems=O.maxPendingItems??O$,this.maxPendingBytes=O.maxPendingBytes??$$,this.serial=new Z$({maxPendingItems:this.maxPendingItems,maxPendingBytes:this.maxPendingBytes,writeTimeoutMs:O.writeTimeoutMs??Q$,sizeOf:e4,write:O.write,onFailure:($)=>{this.failure=$,this.phase="closed",this.buffered.length=0,this.bufferedBytes=0,O.onFailure?.($)}})}async writeInitial(O){await this.offerDire ...

7`)}function C$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map((J)=>({type:"image_url",image_url:{url:J.content}}));if(Q.length===0)return O;let Z=[];if(O.trim())Z.push({type:"text",text:O});return Z.push(...Q),Z}function f$(O,$){return $&&O instanceof $0&&(O.kind==="closed"||O.kind==="aborted")}var L2=()=>{Q9();let O=new d5;O.onError((Y,U)=>{if(Y instanceof p0){let V=new cO("Session runtime capacity is full",{resource:Y.resource,limit:Y.limit});return U.json(V.toObject(),429)}if(Y instanceof sO){let V=new cO("Session projection capacity is full",{resource:Y.r ...

8`),$=await this.runCommand("osascript",["-e",O]);if(M4($))throw Error("Unable to open the macOS folder picker");return L4($.stdout)}async pickOnWindows(){let O=["Add-Type -AssemblyName System.Windows.Forms","$dialog = New-Object System.Windows.Forms.FolderBrowserDialog",'$dialog.Description = "Choose a project folder"',"$dialog.ShowNewFolderButton = $true","if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {"," [Console]::Out.Write($dialog.SelectedPath)","} else {",` [Console]::Out.Write("${A4}")`,"}"].join("; "),$=await this.runCommand("powershell.exe",["-NoProfile","-ST ...

High

Child Process

Package source references child process execution.

dist/chunk-qahz5x5c.jsView on unpkg · L6

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-qahz5x5c.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-qahz5x5c.jsView on unpkg · L1

9Connection: close\r

10\r

11`);return}if(x.pathname==="/terminal/ws"){try{_O(x.searchParams.get("cwd")||X,"cwd")}catch{I.end(`HTTP/1.1 400 Bad Request\r

12Connection: close\r

13\r

14`);return}N.handleUpgrade(F,I,T,(R)=>{N.emit("connection",R,F)})}else I.destroy()});let W=(F)=>{return new Promise((I,T)=>{J.once("error",(x)=>{if(x.code==="EADDRINUSE")T(x);else T(x)}),J.listen(F,$.hostname,()=>{let x=J.address();if(x&&typeof x==="object")I(x.port);else I(F)})})};(async()=>{let F;if($.port===0)try{F=await W(4096)}catch{F=await W(0)}else F=await W($.port);let I=new URL(`http://${$.hostname==="0.0.0.0"?"localhost":$.hostname}:${F}`);Q({url:I,port:F,hostname:$.hostname,stop:async()=>{return new Promise((T)=>{N.close(()=>{J.close(()=>T())})})}})})().catch(Z)})}var o3;((GY)=>{let ...

15

Long lines were clipped for display.

dist/chunk-gfbkrk60.jsView file

Lines 1-38javascript

1import{Te as b0}from"./chunk-0z9nqbd0.js";import{ih as OT}from"./chunk-g4xny949.js";import{oj as yT}from"./chunk-ar5np5h5.js";import{$j as wT,Mj as X0,Uj as E,Wj as D,Xj

dist/chunk-v94ztjtp.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-v94ztjtp.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){p0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(b6(Q.ownerPid)&&A6... [error] ${G.message}`),H.releaseAdmission(),H.resolveCompletion()})()}),this.processes.set(J,H);try{await U.release()}catch(G){throw H.status="aborted",H.endTime=Date.now(),await W... `):r$(J,Math.max(0,X))}${k8}`,truncated:!0}}class x8{latestByPage=new Map;issue($){let Z=AV($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${e9()}`,pageId:$.pageId,pageGene... `).filter((q)=>q.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-v94ztjtp.jsView on unpkg

1import{Da as m9}from"./chunk-6p6ts4kv.js";import{Ga as T,Ha as t0,Ma as SX,Na as WY,Oa as o0}from"./chunk-tw5fr07c.js";import{Pa as a8,Ra as wU,Ta as FU,Ua as V9,kb as _U}from"./ch... L2: const { spawn } = require('node:child_process'); L3: const [ownerPidValue, command, ...args] = process.argv.slice(1); ... L11: if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1) return false; L12: if (process.platform !== 'win32' && process.ppid !== ownerPid) return false; L13: try { ... L79: } else if (ownerIsRunning()) { L80: child.stdin.end(); L81: } else { ... L97: child = spawn(command, args, { L98: env: process.env, L99: stdio: ['pipe', 'inherit', 'inherit'],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-v94ztjtp.jsView on unpkg · L1

dist/chunk-p2sp2e0a.jsView file

Lines 1-3javascript

1import{Cj as S}from"./chunk-v5hzk7j2.js";import{rk as f}from"./chunk-zkzhm39s.js";import*as $ from"fs/promises";import*as K from"path";import j from

dist/chunk-b8m7zc7t.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blade-code@0.10.41 matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.41 similarity = 0.384 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-b8m7zc7t.jsView on unpkg