registry / blade-code / 0.10.189

blade-code@0.10.189

🗡️ Blade Code - 智能代码助手命令行工具

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 4.41 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, code.visualstudio.com, duckduckgo.com, example.com, gateway.example.com, github.com, glama.ai, mcp.exa.ai, r.jina.ai, radix-ui.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, search.ononoki.org, searx.be, searx.tiekoetter.com, searx.work, tauri.localhost, www.npmjs.com, www.w3.org

Source & flagged code

10 flagged

dist/chunk-csvcfvx0.jsView file

Lines 1-15javascript

1import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-1qhp6rrm.js";import{j as o1}from"./chunk-zj1g4nbq.js";import{v as a0,w as y2}from"./chunk-xcjncf93.js";import{A as m0,x as g2,y as p2,z as v2}from"./chunk-fj6pkaa7.js";import{B as C2,C as U$,D as H$,E as F$,F as z0,G as N$}from"./chunk-0zv0rbzz.js";import{$ as I2,Ea as u3,J as B2,K as u1,L as v3,O as D2,P as e0,Q as d4,R as i1,S as g$,T as A4,U as j4,V as K0,W as L2,X as M2,Y as D$,Z as w1,aa as R2,ba as b4,ca as j0,da as H0,ga as q1,ha as E1,ia as O5,ja as q2,ka as E2,la as r2,ma as e2,na as O3,oa as $3,pa as Q3,qa as Z3,ra as J3,sa ...

2`;if(O.event!==void 0)$+=`event: ${O.event}

3`;for(let Q of O.data.split(/\r\n|\r|\n/))$+=`data: ${Q}

4`;if(O.retry!==void 0)$+=`retry: ${O.retry}

5`;return $+=`

6`,Buffer.byteLength($)}class K1{serial;buffered=[];bufferedBytes=0;nextOrder=0;phase="buffering";highestDeliveredSequence=0;highestReplaySequence=0;failure;maxPendingItems;maxPendingBytes;constructor(O){this.maxPendingItems=O.maxPendingItems??U$,this.maxPendingBytes=O.maxPendingBytes??H$,this.serial=new N$({maxPendingItems:this.maxPendingItems,maxPendingBytes:this.maxPendingBytes,writeTimeoutMs:O.writeTimeoutMs??F$,sizeOf:w$,write:O.write,onFailure:($)=>{this.failure=$,this.phase="closed",this.buffered.length=0,this.bufferedBytes=0,O.onFailure?.($)}})}async writeInitial(O){await this.offerDire ...

7`)}function a$(O,$){let Q=($??[]).filter((J)=>J.type==="image"&&typeof J.content==="string").map((J)=>({type:"image_url",image_url:{url:J.content}}));if(Q.length===0)return O;let Z=[];if(O.trim())Z.push({type:"text",text:O});return Z.push(...Q),Z}function n$(O,$){return $&&O instanceof z0&&(O.kind==="closed"||O.kind==="aborted")}var c2=()=>{E9();let O=new U9;O.onError((Y,K)=>{if(Y instanceof a0){let z=new rO("Session runtime capacity is full",{resource:Y.resource,limit:Y.limit});return K.json(z.toObject(),429)}if(Y instanceof Z0){let z=new rO("Session projection capacity is full",{resource:Y.r ...

8`),$=await this.runCommand("osascript",["-e",O]);if(C4($))throw Error("Unable to open the macOS folder picker");return E4($.stdout)}async pickOnWindows(){let O=["Add-Type -AssemblyName System.Windows.Forms","$dialog = New-Object System.Windows.Forms.FolderBrowserDialog",'$dialog.Description = "Choose a project folder"',"$dialog.ShowNewFolderButton = $true","if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {"," [Console]::Out.Write($dialog.SelectedPath)","} else {",` [Console]::Out.Write("${S4}")`,"}"].join("; "),$=await this.runCommand("powershell.exe",["-NoProfile","-ST ...

High

Child Process

Package source references child process execution.

dist/chunk-csvcfvx0.jsView on unpkg · L6

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-csvcfvx0.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-csvcfvx0.jsView on unpkg · L1

9Connection: close\r

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-csvcfvx0.jsView on unpkg · L1

10\r

11`);return}if(L.pathname==="/terminal/ws"){try{wO(L.searchParams.get("cwd")||V,"cwd")}catch{j.end(`HTTP/1.1 400 Bad Request\r

12Connection: close\r

13\r

14`);return}X.handleUpgrade(H,j,T,(q)=>{X.emit("connection",q,H)})}else j.destroy()});let w=(H)=>{return new Promise((j,T)=>{J.once("error",(L)=>{if(L.code==="EADDRINUSE")T(L);else T(L)}),J.listen(H,$.hostname,()=>{let L=J.address();if(L&&typeof L==="object")j(L.port);else j(H)})})};(async()=>{let H;if($.port===0)try{H=await w(4096)}catch{H=await w(0)}else H=await w($.port);let j=new URL(`http://${$.hostname==="0.0.0.0"?"localhost":$.hostname}:${H}`);Q({url:j,port:H,hostname:$.hostname,stop:async()=>{return new Promise((T)=>{X.close(()=>{J.close(()=>T())})})}})})().catch(Z)})}var x5;((sY)=>{let ...

Long lines were clipped for display.

dist/chunk-km4beerf.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-km4beerf.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){l0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${G.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(J,z);try{await W.release()}catch(G){throw z.status="aborted",z.endTime=Date.now(),await U... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=JU($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${_3()}`,pageId:$.pageId,pageGene... `).filter((w)=>w.toLocaleLowerCase("en-US").includes(B)),D=G.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-km4beerf.jsView on unpkg

1import{Ga as W3}from"./chunk-g01mth5d.js";import{Ja as T,Ka as $$,Pa as HW,Qa as fY,Ra as e0}from"./chunk-wv8twmpb.js";import{$a as BX,Sa as Y5,Va as pZ,Za as tZ,_a as zX,bb as nW,... L2: const { spawn } = require('node:child_process'); L3: const [ownerPidValue, command, ...args] = process.argv.slice(1); ... L11: if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1) return false; L12: if (process.platform !== 'win32' && process.ppid !== ownerPid) return false; L13: try { ... L79: } else if (ownerIsRunning()) { L80: child.stdin.end(); L81: } else { ... L97: child = spawn(command, args, { L98: env: process.env, L99: stdio: ['pipe', 'inherit', 'inherit'],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-km4beerf.jsView on unpkg · L1

dist/chunk-qrvbampy.jsView file

Lines 1-3javascript

1import{Xj as I}from"./chunk-c3hbabe1.js";import{Mk as f}from"./chunk-eg3ms291.js";import*as j from"fs/promises";import*as S from"path";import X from

dist/chunk-g01mth5d.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-g01mth5d.jsView on unpkg

dist/chunk-jj4ggb04.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-jj4ggb04.jsView on unpkg

dist/chunk-1368jv5c.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-1368jv5c.jsView on unpkg

blade-code@0.10.189

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code