1#!/usr/bin/env node
L2: "use strict";var nl=Object.create;var On=Object.defineProperty;var ol=Object.getOwnPropertyDescriptor;var il=Object.getOwnPropertyNames;var sl=Object.getPrototypeOf,al=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],d=r.commandDescription(e);d.length>0&&(l=l.concat([r.wrap(d,o,0),""]));let u=r.visibleArguments(e).map(h=>a...
...
L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde
CriticalRemote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L1 10Trigger-reachable chain: manifest.main -> dist/index.js
L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commande
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ki(t){r...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ki(t){r...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L10 22package = bridge-agent; repositoryIdentity = jerico; dependency = node-pty
L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ki(t){r...
L24: `).join(`\r
HighCopied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L22 1Cross-file remote execution chain: dist/index.js spawns dist/bridge-mcp.cjs; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: "use strict";var nl=Object.create;var On=Object.defineProperty;var ol=Object.getOwnPropertyDescriptor;var il=Object.getOwnPropertyNames;var sl=Object.getPrototypeOf,al=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],d=r.commandDescription(e);d.length>0&&(l=l.concat([r.wrap(d,o,0),""]));let u=r.visibleArguments(e).map(h=>a...
...
L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - spe
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L1 395Type "yes" to continue: `);let e="";process.stdin.setEncoding("utf-8"),process.stdin.resume(),process.stdin.on("data",r=>{e+=r,e.includes(`
L396: `)&&(process.stdin.pause(),t(e.trim().toLowerCase()==="yes"))})})}var ci=v(require("path")),Jc=require("node:os");re();var Yp=ci.default.join((0,Jc.homedir)(),"Library","LaunchAgen...
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L395 1#!/usr/bin/env node
L2: "use strict";var nl=Object.create;var On=Object.defineProperty;var ol=Object.getOwnPropertyDescriptor;var il=Object.getOwnPropertyNames;var sl=Object.getPrototypeOf,al=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],d=r.commandDescription(e);d.length>0&&(l=l.concat([r.wrap(d,o,0),""]));let u=r.visibleArguments(e).map(h=>a...
...
L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1 1#!/usr/bin/env node
L2: "use strict";var nl=Object.create;var On=Object.defineProperty;var ol=Object.getOwnPropertyDescriptor;var il=Object.getOwnPropertyNames;var sl=Object.getPrototypeOf,al=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],d=r.commandDescription(e);d.length>0&&(l=l.concat([r.wrap(d,o,0),""]));let u=r.visibleArguments(e).map(h=>a...
...
L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L11: (Did you mean ${n[0]}?)`:""}bi.suggestSimilar=ml});var Ii=H(Ei=>{var yl=require("node:events").EventEmitter,Bn=require("node:child_process"),Le=require("node:path"),$n=require("nod...
L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1