blade-code@0.10.185: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

blade-code@0.10.185: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/chunk-e3r2zfct.jsView file

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Child Process

Package source references child process execution.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/blade.js -> dist/chunk-hn0p92n5.js -> dist/chunk-e3r2zfct.js L1: import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-e3r2zfct.jsView on unpkg · L1

dist/chunk-j1xkhc0r.jsView file

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue a... L2: `,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLAD... L3: L4: ...[middle omitted; read the private prompt artifact for the complete request]... L5: L6: `;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof Error&&(_.message.startsWith("Prompt artifact")||_.message.startsWith("User... L7: `),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async res

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-j1xkhc0r.jsView on unpkg · L1

dist/chunk-m2gh9f07.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-m2gh9f07.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(J,z);try{await W.release()}catch(G){throw z.status="aborted",z.endTime=Date.now(),await U... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JU($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${_3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-m2gh9f07.jsView on unpkg

dist/chunk-7gya2kat.jsView file

1Cross-file remote execution chain: dist/chunk-7gya2kat.js spawns dist/chunk-m2gh9f07.js; helper contains network access plus dynamic code execution. L1: import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-wr1m9dr0.js";import{j as o1}from"./chunk-zj1g4nbq.js";import{v as a0,w as y2}from"./chunk-y6zhrc3p.js";import{A as m0,x ... L2: `;if(O.event!==void 0)$+=`event: ${O.event} L3: `;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q} L4: `;if(O.retry!==void 0)$+=`retry: ${O.retry} L5: `;return $+=` L6: `,Buffer.byteLength($)}class K1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function a$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-7gya2kat.jsView on unpkg · L1

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-hn0p92n5.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-hn0p92n5.jsView on unpkg

Source & flagged code

10 flagged

dist/chunk-e3r2zfct.jsView file

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Child Process

Package source references child process execution.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-e3r2zfct.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/blade.js -> dist/chunk-hn0p92n5.js -> dist/chunk-e3r2zfct.js L1: import{Xj as I}from"./chunk-y8qs0rys.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/chunk-e3r2zfct.jsView on unpkg · L1

dist/chunk-j1xkhc0r.jsView file

1import{$e as a2,Ae as U1,Be as A0,Ce as B1,De as H1,Fe as d2,Me as i2,Ne as C0,Ue as p_,We as N1,Ye as r2,Ze as o2,_e as q1,oe as u2,pe as e,qe as h2,re as Z1,se as l2,te as v,ue a... L2: `,"utf8"),!0}catch(W){if(R_(W,"EEXIST"))return!1;if($)await W_.unlink(_).catch(()=>{return});throw W}finally{await $?.close().catch(()=>{return})}}class $_ extends Error{code="BLAD... L3: L4: ...[middle omitted; read the private prompt artifact for the complete request]... L5: L6: `;function I1(_,X){return _ instanceof Error&&"code"in _&&_.code===X}function v_(_,X){let $=_ instanceof Error&&(_.message.startsWith("Prompt artifact")||_.message.startsWith("User... L7: `),Z=P1(_);return{content:I4(J,Z,W.contentLayout,x_-Buffer.byteLength(Y),Y),metadata:{...X,userPromptArtifact:Q},offloaded:!0}}async res

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-j1xkhc0r.jsView on unpkg · L1

dist/chunk-m2gh9f07.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-m2gh9f07.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(J,z);try{await W.release()}catch(G){throw z.status="aborted",z.endTime=Date.now(),await U... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JU($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${_3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-m2gh9f07.jsView on unpkg

dist/chunk-7gya2kat.jsView file

1Cross-file remote execution chain: dist/chunk-7gya2kat.js spawns dist/chunk-m2gh9f07.js; helper contains network access plus dynamic code execution. L1: import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-wr1m9dr0.js";import{j as o1}from"./chunk-zj1g4nbq.js";import{v as a0,w as y2}from"./chunk-y6zhrc3p.js";import{A as m0,x ... L2: `;if(O.event!==void 0)$+=`event: ${O.event} L3: `;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q} L4: `;if(O.retry!==void 0)$+=`retry: ${O.retry} L5: `;return $+=` L6: `,Buffer.byteLength($)}class K1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendi... L7: `)}function a$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-7gya2kat.jsView on unpkg · L1

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-hn0p92n5.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-hn0p92n5.jsView on unpkg