registry / blade-code / 0.10.177

blade-code@0.10.177

🗡️ Blade Code - 智能代码助手命令行工具

AI Security Review

scanned 26d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Network and command features are reachable through the installed CLI's user-invoked functions, not package installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user explicitly runs Blade CLI features such as update, browser, IDE, or model-provider commands.

Impact

These features can access configured model services or run documented local commands, but no unconsented installation-time behavior was found.

Mechanism

User-invoked AI CLI operations and self-update check.

AI rationale

Static hints overstated the risk: source inspection found no lifecycle trigger, self-dependency, credential redirection, or automatic exfiltration. The command and network primitives are aligned with an interactive AI CLI.

Decision evidence

public snapshot

AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The manifest has no install, preinstall, or postinstall hook.
The flagged update code runs only through the explicit update command and installs the same package from the npm registry.
The inspected provider configuration exposes official OpenAI and Anthropic defaults; no fixed unofficial credential gateway was found.
The update command installs blade-code from the official npm registry.
Update checks query the blade-code latest-version endpoint on npm.
The browser installer launches Playwright’s chromium install command without a shell.
The process helper tracks an owner PID before starting a child process.
The server’s default hostname is loopback-only (127.0.0.1).

Evidence against

The CLI can execute commands and make network requests when users invoke its assistant, browser, IDE, and update features.
Bundled code is heavily minified, which limits line-level review detail but is consistent across the distribution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 4.41 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, code.visualstudio.com, duckduckgo.com, example.com, gateway.example.com, github.com, glama.ai, mcp.exa.ai, r.jina.ai, radix-ui.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, search.ononoki.org, searx.be, searx.tiekoetter.com, searx.work, tauri.localhost, www.npmjs.com, www.w3.org

Source & flagged code

10 flagged

dist/chunk-ycafgg7y.jsView file

Lines 1-21javascript

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue as G1,ve as c2,we as p2,xe as V1,ye as L1,ze as n2}from"./chunk-y5wngtz0.js";import{vg as o_}from"./chunk-50vwafn5.js";import{rh as a_}from"./chunk-vbjgcn49.js";import{Vi as v2,Wi as P2,Xi as x_,Yi as Q0,Zi as w_}from"./chunk-5v0jcyea.js";import{bj as f1}from"./chunk-2f8d0km4.js";import{Dj as H0}from"./chunk-2mk914vk.js";import{Qj as i_,Tj as r_}from"./chunk-4cdk4mds.js";import{Xj as __}from"./chunk-020t9es1.js";impor ...

2`,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLADE_SESSION_IN_USE";constructor(_){super(_?`Session is already active in another Blade process (PID ${_}). Stop that process or choose a different session.`:"Session is already active in another Blade process. Stop that process or choose a different session.");this.name="SessionInUseError"}}async function k1(_,X,$=!1){let W,J;try{J=await D4.lock(_,{realpath:!1,retries:$?{retries:50,minTimeout:10,maxTimeout:100,factor:1 ...

High

Child Process

Package source references child process execution.

dist/chunk-ycafgg7y.jsView on unpkg · L1

4...[middle omitted; read the private prompt artifact for the complete request]...

6`;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof

7`),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async restore(_,X){let $=y0(X);if(!$&&j0(X))throw Error("Prompt artifact reference is invalid");if(!$)return _;let W;try{W=await this.readVerified($.id,$.sizeBytes)}catch(V){throw v_(V,"Prompt artifact is unavailable or invalid")}let J=W.toString("utf8");if(J.length!==$.textChars)throw Error("Prompt artifact character count does not match its reference");let O=P1(_);if(!$.contentLayout){if(O.length>0)throw Error("Prompt artifact content layout is missing");return J}let ...

8`));return{version:f0,id:W,sha256:W,sizeBytes:_.length,textChars:X,inlineBytes:x_-O,...$?{contentLayout:$}:{}}}async verify(_,X){await this.readVerified(_,X)}async readVerified(_,X

9`)}function _2(_,X){return{reviewId:_.reviewId,phase:"completed",status:X.status,target:{kind:_.target.kind,label:_.target.label,..._.target.baseSha?{reference:_.target.baseSha}:{},..._.target.commitSha?{reference:_.target.commitSha}:{}},overallExplanation:X.overallExplanation,findings:X.findings.map(($)=>({title:$.title,body:$.body,priority:$.priority,confidenceScore:$.confidenceScore,codeLocation:{...$.codeLocation}})),...X.error?{error:X.error}:{}}}var n0=1;var l0=2000,n4='<token-budget-handoff version="1">',HW="handoff-message-",d4=128,i4=["version","messageId","observedPromptTokens","avai ...

10`)}function s4(_){let X=$2(_);if(new TextEncoder().encode(X).length>l0)throw Error(`Token budget handoff reminder exceeds ${l0} bytes`);return

11... (display clipped) ...

12`,W=_.indexOf(`

13`),J=W>=0&&/^(?:stdout|stderr):$/.test(_.slice(0,W))?`${_.slice(0,W)}

14`:"",O=J?_.slice(J.length):_,Q=X-J.length-$.length;if(Q<=0)return G2(_,X);let Y=Math.min(Math.floor(Q/3),O.length),Z=Math.max(0,Q-Y);return J+e0(O,Y)+$+G2(O,Z)}function LX(_){let X=_.split(`

15`),$=X.at(-1);if(!$?.startsWith("Output truncated"))return{body:_};return{body:X.slice(0,-1).join(`

16`),suffix:$}}function UX(_){let $=_.indexOf(`

17stderr:

18`);if(!_.startsWith(`stdout:

19`)||$<0)return[_];return[_.slice(0,$),_.slice($+1)]}function IW(_,X){if(!Number.isSafeInteger(X)||X<=0)throw Error("maxChars must be a positive safe integer");if(!_.detail||_.detail.length<=X)return _;let{body:$,suffix:W}=LX(_.detail),J=W?`

20${e0(W,X)}`:"",O=Math.max(0,X-J.length),Q=UX($),Y;if(Q.length===2){let U=Math.max(0,O-1),G=Math.floor(U/2),L=U-G;Y=`${s0(Q[0],G)}

21${s0(Q[1],L)}`}else Y=s0($,O);let Z=e0(`${Y}${J}`,X);return{..._,detail:Z}}import{createHash as BX}from"node:crypto";import B2 from"node:path";var q0=16777216,U2=65536,lW=1048576,HX=8,T0=200,NX=/(?:^|[_-])(?:api[_-]?key|authorization|bearer|cookie|credential|password|passwd|private[_-]?key|refresh[_-]?token|secret|session[_-]?token|token)(?:$|[_-])/i,qX=/(?<![:/A-Za-z0-9._-])\/[^\s"'`<>]+/g,TX=/(?<![A-Za-z0-9._-

Long lines were clipped for display.

dist/chunk-gcmw83t0.jsView file

Lines 1-3javascript

1import{Xj as I}from"./chunk-020t9es1.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from

dist/chunk-d2nz3pfs.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-d2nz3pfs.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(J,z);try{await W.release()}catch(G){throw z.status="aborted",z.endTime=Date.now(),await U... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JU($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${_3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-d2nz3pfs.jsView on unpkg

dist/chunk-abpf6meb.jsView file

Lines 1-15javascript

1import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-95b7eanh.js";import{j as o1}from"./chunk-zj1g4nbq.js";import{v as a0,w as y2}from

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-dd6rtthc.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-dd6rtthc.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/chunk-ycafgg7y.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-ycafgg7y.jsView on unpkg · L1

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue a... L2: `,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLAD... L3: L4: ...[middle omitted; read the private prompt artifact for the complete request]... L5: L6: `;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof Error&&(_.message.startsWith("Prompt artifact")||_.message.startsWith("User... L7: `),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async res

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-ycafgg7y.jsView on unpkg · L1

dist/chunk-gcmw83t0.jsView file

1import{Xj as I}from"./chunk-020t9es1.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-gcmw83t0.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-gcmw83t0.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/blade.js -> dist/chunk-dd6rtthc.js -> dist/chunk-gcmw83t0.js L1: import{Xj as I}from"./chunk-020t9es1.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-gcmw83t0.jsView on unpkg · L1

dist/chunk-d2nz3pfs.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-d2nz3pfs.jsView on unpkg

dist/chunk-abpf6meb.jsView file

1Cross-file remote execution chain: dist/chunk-abpf6meb.js spawns dist/chunk-d2nz3pfs.js; helper contains network access plus dynamic code execution. L1: import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-95b7eanh.js";import{j as o1}from"./chunk-zj1g4nbq.js";import{v as a0,w as y2}from"./chunk-nxxnm4qc.js";import{A as m0,x ... L2: `;if(O.event!==void 0)$+=`event: ${O.event} L3: `;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q} L4: `;if(O.retry!==void 0)$+=`retry: ${O.retry} L5: `;return $+=` L6: `,Buffer.byteLength($)}class K1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function a$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-abpf6meb.jsView on unpkg · L1

dist/chunk-g01mth5d.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-dd6rtthc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-dd6rtthc.jsView on unpkg

Findings

9 High2 Medium5 Low

HighChild Processdist/chunk-ycafgg7y.js

HighSame File Env Network Executiondist/chunk-gcmw83t0.js

HighCredential Redirect Persistencedist/chunk-d2nz3pfs.js

HighCommand Output Exfiltrationdist/chunk-gcmw83t0.js

HighCross File Remote Execution Contextdist/chunk-abpf6meb.js

HighTrigger Reachable Command Output Exfiltrationdist/chunk-gcmw83t0.js

HighKnown Malware Source Similaritydist/chunk-g01mth5d.js

HighKnown Malware Source Similaritydist/chunk-jj4ggb04.js

HighKnown Malware Source Similaritydist/chunk-dd6rtthc.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/chunk-ycafgg7y.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to blade-code@0.10.177.

See version security history for other recorded verdicts.

Review the evidence and your use of blade-code@0.10.177 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 04:33:14.509Z (UTC).