registry / blade-code / 0.10.204

blade-code@0.10.204

⚠ Under review

🗡️ Blade Code - 智能代码助手命令行工具

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 17 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 4.42 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, code.visualstudio.com, duckduckgo.com, example.com, gateway.example.com, github.com, glama.ai, mcp.exa.ai, r.jina.ai, radix-ui.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, search.ononoki.org, searx.be, searx.tiekoetter.com, searx.work, tauri.localhost, www.npmjs.com, www.w3.org

Source & flagged code

11 flagged

dist/chunk-n52n2w5v.jsView file

Lines 1-3javascript

1import*as z from"node:os";import*as x from"node:path";function F(){return process.env.BLADE_STORAGE_ROOT||x.join(z.homedir(),".blade")}import{AsyncLocalStorage as Lq}from"node:async_hooks";import{createHash as Vq}from"node:crypto";import{lstat as L,mkdir as Cq,readdir as bq,realpath as N}from"node:fs/promises";import Z from"node:path";import{createHash as Gq}from"node:crypto";var E=new WeakSet,j=new WeakSet,Jq={"not-absolute":"ACP remote file path must be absolute","style-mismatch":"ACP remote file path does not match the expected style","drive-relative":"ACP remote file path cannot be drive-r ...

2export{F as gk,_ as hk,Qq as ik,Uq as jk,gq as kk,Rq as lk,C as mk,Sq as nk,X as ok,iq

Long lines were clipped for display.

dist/chunk-rwm71p4g.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blade-code@0.10.189 matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.189 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-rwm71p4g.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chunk-rwm71p4g.js: `,{encoding:"utf8",mode:384,fsync:!0}),Q}remove($){p0.rmSync(this.filePath($),{force:!0})}async reapOrphans(){let $=0,Z=0,J=0,Y=0;for(let Q of this.readAll()){if(R6(Q.ownerPid)&&S6... [error] ${B.message}`),z.releaseAdmission(),z.resolveCompletion()})()}),this.processes.set(J,z);try{await W.release()}catch(B){throw z.status="aborted",z.endTime=Date.now(),await H... `):o$(J,Math.max(0,X))}${m8}`,truncated:!0}}class c8{latestByPage=new Map;issue($){let Z=XH($.snapshot,$.maxBytes),J={snapshotId:`browser_snapshot_${F3()}`,pageId:$.pageId,pageGene... `).filter((q)=>q.toLocaleLowerCase("en-US").includes(G)),D=B.slice(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chunk-rwm71p4g.jsView on unpkg

1import{Ga as V3}from"./chunk-vzdsext4.js";import{Ja as T,Ka as e0,Pa as GW,Qa as PY,Ra as t0}from"./chunk-p8cmxhbr.js";import{$a as GX,Sa as Y5,Va as pZ,Za as tZ,_a as BX,bb as oW,... L2: const { spawn } = require('node:child_process'); L3: const [ownerPidValue, command, ...args] = process.argv.slice(1); ... L11: if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1) return false; L12: if (process.platform !== 'win32' && process.ppid !== ownerPid) return false; L13: try { ... L79: } else if (ownerIsRunning()) { L80: child.stdin.end(); L81: } else { ... L97: child = spawn(command, args, { L98: env: process.env, L99: stdio: ['pipe', 'inherit', 'inherit'],

dist/chunk-f4d8312x.jsView file

1import{Yj as I}from"./chunk-z0m9j0e2.js";import{Nk as f}from"./chunk-cjfb4kjp.js";import*as j from"fs/promises";import*as S from"path";import X from"semver";import{ProxyAgent as R,... L2: export{A as k,V as l,v as m,p as n,h as o};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-f4d8312x.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-f4d8312x.jsView on unpkg · L1

dist/chunk-7d3msqg3.jsView file

Lines 1-15javascript

1import{e as U3,f as H3,g as R3,h as s0,i as q3}from"./chunk-8j0z248z.js";import{j as o1}from"./chunk-hnvvve5d.js";import{v as a0,w as y2}from

dist/chunk-p0wyhp5a.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-a60cmnmz.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-p0wyhp5a.jsView on unpkg

dist/chunk-vzdsext4.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-6p6ts4kv.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-vzdsext4.jsView on unpkg

dist/chunk-gzdk86fm.jsView file

•matchType = normalized_sha256 matchedPackage = blade-code@0.10.130 matchedPath = dist/chunk-kfkvdj49.js matchedIdentity = npm:YmxhZGUtY29kZQ:0.10.130 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-gzdk86fm.jsView on unpkg

blade-code@0.10.204

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code