blade-code@0.10.173: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

blade-code@0.10.173: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/chunk-ppvnwvjd.jsView file

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue a... L2: `,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLAD...

High

Child Process

Package source references child process execution.

dist/chunk-ppvnwvjd.jsView on unpkg · L1

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue a... L2: `,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLAD... L3: L4: ...[middle omitted; read the private prompt artifact for the complete request]... L5: L6: `;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof Error&&(_.message.startsWith("Prompt artifact")||_.message.startsWith("User... L7: `),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async res

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-ppvnwvjd.jsView on unpkg · L1

dist/chunk-e68pf4kz.jsView file

1import{Xj as I}from"./chunk-4na3qs1a.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-e68pf4kz.jsView on unpkg · L1

1import{Xj as I}from"./chunk-4na3qs1a.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-e68pf4kz.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/blade.js -> dist/chunk-bgmnkads.js -> dist/chunk-e68pf4kz.js L1: import{Xj as I}from"./chunk-4na3qs1a.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-e68pf4kz.jsView on unpkg · L1

dist/chunk-0zqz7kn4.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-0zqz7kn4.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),H.releaseAdmission(),H.resolveCompletion()})()}),this.processes.set(J,H);try{await z.release()}catch(G){throw H.status="aborted",H.endTime=Date.now(),await V... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JV($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${F3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-0zqz7kn4.jsView on unpkg

dist/chunk-bgmnkads.jsView file

1Cross-file remote execution chain: dist/chunk-bgmnkads.js spawns dist/chunk-0zqz7kn4.js; helper contains network access plus dynamic code execution. L1: import{e as $X,f as JX,h as S$,i as M4}from"./chunk-59egcy7t.js";import{l as eX,m as $Z,n as JZ}from"./chunk-e68pf4kz.js";import{A as q4,y as A9,z as b9}from"./chunk-zrx95vr9.js";i... L2: `),T9=$}function q6($,J,Y){try{let Z=IZ();SZ(Z);let X=new Date().toISOString(),Q=Y?` | ${JSON.stringify(Y)}`:"",G=`[${X}] [${$}] ${J}${Q} ... L10: `)});break}case"project_rules_loaded":{let Q=`Project rules loaded: ${X.files.length}`+(X.blockedWrite?" (write retry required)":"");$.sessionActions.addToolMessage(Q,{toolName:"Pr... L11: `)});break}case"steering_applied":if(Z(X.messages),$.appActions.projectFollowUpQueue(X.queue,$.followUpQueueOwner),X.recove

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-bgmnkads.jsView on unpkg · L1

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-jk6r6z9c.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jk6r6z9c.jsView on unpkg

Source & flagged code

10 flagged

dist/chunk-ppvnwvjd.jsView file

Lines 1-21javascript

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue as G1,ve as c2,we as p2,xe as V1,ye as L1,ze as n2}from"./chunk-y5wngtz0.js";import{vg as o_}from"./chunk-50vwafn5.js";import{rh as a_}from"./chunk-vbjgcn49.js";import{Vi as v2,Wi as P2,Xi as x_,Yi as Q0,Zi as w_}from"./chunk-5v0jcyea.js";import{bj as f1}from"./chunk-2f8d0km4.js";import{Dj as H0}from"./chunk-2mk914vk.js";import{Qj as i_,Tj as r_}from"./chunk-4cdk4mds.js";import{Xj as __}from"./chunk-4na3qs1a.js";impor ...

2`,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLADE_SESSION_IN_USE";constructor(_){super(_?`Session is already active in another Blade process (PID ${_}). Stop that process or choose a different session.`:"Session is already active in another Blade process. Stop that process or choose a different session.");this.name="SessionInUseError"}}async function k1(_,X,$=!1){let W,J;try{J=await D4.lock(_,{realpath:!1,retries:$?{retries:50,minTimeout:10,maxTimeout:100,factor:1 ...

High

Child Process

Package source references child process execution.

dist/chunk-ppvnwvjd.jsView on unpkg · L1

3

4...[middle omitted; read the private prompt artifact for the complete request]...

5

6`;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof

7`),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async restore(_,X){let $=y0(X);if(!$&&j0(X))throw Error("Prompt artifact reference is invalid");if(!$)return _;let W;try{W=await this.readVerified($.id,$.sizeBytes)}catch(V){throw v_(V,"Prompt artifact is unavailable or invalid")}let J=W.toString("utf8");if(J.length!==$.textChars)throw Error("Prompt artifact character count does not match its reference");let O=P1(_);if(!$.contentLayout){if(O.length>0)throw Error("Prompt artifact content layout is missing");return J}let ...

8`));return{version:f0,id:W,sha256:W,sizeBytes:_.length,textChars:X,inlineBytes:x_-O,...$?{contentLayout:$}:{}}}async verify(_,X){await this.readVerified(_,X)}async readVerified(_,X

9`)}function _2(_,X){return{reviewId:_.reviewId,phase:"completed",status:X.status,target:{kind:_.target.kind,label:_.target.label,..._.target.baseSha?{reference:_.target.baseSha}:{},..._.target.commitSha?{reference:_.target.commitSha}:{}},overallExplanation:X.overallExplanation,findings:X.findings.map(($)=>({title:$.title,body:$.body,priority:$.priority,confidenceScore:$.confidenceScore,codeLocation:{...$.codeLocation}})),...X.error?{error:X.error}:{}}}var n0=1;var l0=2000,n4='<token-budget-handoff version="1">',HW="handoff-message-",d4=128,i4=["version","messageId","observedPromptTokens","avai ...

10`)}function s4(_){let X=$2(_);if(new TextEncoder().encode(X).length>l0)throw Error(`Token budget handoff reminder exceeds ${l0} bytes`);return

11... (display clipped) ...

12`,W=_.indexOf(`

13`),J=W>=0&&/^(?:stdout|stderr):$/.test(_.slice(0,W))?`${_.slice(0,W)}

14`:"",O=J?_.slice(J.length):_,Q=X-J.length-$.length;if(Q<=0)return G2(_,X);let Y=Math.min(Math.floor(Q/3),O.length),Z=Math.max(0,Q-Y);return J+e0(O,Y)+$+G2(O,Z)}function LX(_){let X=_.split(`

15`),$=X.at(-1);if(!$?.startsWith("Output truncated"))return{body:_};return{body:X.slice(0,-1).join(`

16`),suffix:$}}function UX(_){let $=_.indexOf(`

17stderr:

18`);if(!_.startsWith(`stdout:

19`)||$<0)return[_];return[_.slice(0,$),_.slice($+1)]}function IW(_,X){if(!Number.isSafeInteger(X)||X<=0)throw Error("maxChars must be a positive safe integer");if(!_.detail||_.detail.length<=X)return _;let{body:$,suffix:W}=LX(_.detail),J=W?`

20${e0(W,X)}`:"",O=Math.max(0,X-J.length),Q=UX($),Y;if(Q.length===2){let U=Math.max(0,O-1),G=Math.floor(U/2),L=U-G;Y=`${s0(Q[0],G)}

21${s0(Q[1],L)}`}else Y=s0($,O);let Z=e0(`${Y}${J}`,X);return{..._,detail:Z}}import{createHash as BX}from"node:crypto";import B2 from"node:path";var q0=16777216,U2=65536,lW=1048576,HX=8,T0=200,NX=/(?:^|[_-])(?:api[_-]?key|authorization|bearer|cookie|credential|password|passwd|private[_-]?key|refresh[_-]?token|secret|session[_-]?token|token)(?:$|[_-])/i,qX=/(?<![:/A-Za-z0-9._-])\/[^\s"'`<>]+/g,TX=/(?<![A-Za-z0-9._-

Long lines were clipped for display.

dist/chunk-e68pf4kz.jsView file

Lines 1-3javascript

1import{Xj as I}from"./chunk-4na3qs1a.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from

dist/chunk-0zqz7kn4.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-0zqz7kn4.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),H.releaseAdmission(),H.resolveCompletion()})()}),this.processes.set(J,H);try{await z.release()}catch(G){throw H.status="aborted",H.endTime=Date.now(),await V... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JV($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${F3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-0zqz7kn4.jsView on unpkg

dist/chunk-bgmnkads.jsView file

Lines 1-21javascript

1import{e as $X,f as JX,h as S$,i as M4}from"./chunk-59egcy7t.js";import{l as eX,m as $Z,n as JZ}from"./chunk-e68pf4kz.js";import{A as q4,y as

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-jk6r6z9c.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jk6r6z9c.jsView on unpkg