1#!/usr/bin/env node
L2: "use strict";var kl=Object.create;var Br=Object.defineProperty;var El=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var xl=Object.getPrototypeOf,Ol=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(l=l.concat([n.wrap(d,o,0),""]));let u=n.visibleArguments(e).map(g=>a...
...
L10: (Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidde
CriticalRemote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L1 10Trigger-reachable chain: manifest.main -> dist/index.js
L10: (Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${r.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof n=="function"?s=n({error:i.error,command:i.command}):s=n,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let n=this._getHelpOption();n&&e.find(o=>n.is(o))&&(this.outputHelp(),this._exit(0,"commande
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=!0),this._registerComma...
HighChild Process
Package source references child process execution.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${r.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof n=="function"?s=n({error:i.error,command:i.command}):s=n,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let n=this._getHelpOption();n&&e.find(o=>n.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ji(t){r...
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L10 10(Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=!0),this._registerComma...
...
L22: Expecting one of '${r.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof n=="function"?s=n({error:i.error,command:i.command}):s=n,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let n=this._getHelpOption();n&&e.find(o=>n.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ji(t){r...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L10 22package = bridge-agent; repositoryIdentity = jerico; dependency = node-pty
L22: Expecting one of '${r.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof n=="function"?s=n({error:i.error,command:i.command}):s=n,s&&i.write(`${s}
L23: `)}),this}_outputHelpIfRequested(e){let n=this._getHelpOption();n&&e.find(o=>n.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ji(t){r...
L24: `).join(`\r
HighCopied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L22 1Cross-file remote execution chain: dist/index.js spawns dist/bridge-mcp.cjs; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: "use strict";var kl=Object.create;var Br=Object.defineProperty;var El=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var xl=Object.getPrototypeOf,Ol=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(l=l.concat([n.wrap(d,o,0),""]));let u=n.visibleArguments(e).map(g=>a...
...
L10: (Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - spe
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L1 398Type "yes" to continue: `);let e="";process.stdin.setEncoding("utf-8"),process.stdin.resume(),process.stdin.on("data",n=>{e+=n,e.includes(`
L399: `)&&(process.stdin.pause(),t(e.trim().toLowerCase()==="yes"))})})}var ki=v(require("path")),hl=require("node:os");ne();var Tf=ki.default.join((0,hl.homedir)(),"Library","LaunchAgen...
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L398 1#!/usr/bin/env node
L2: "use strict";var kl=Object.create;var Br=Object.defineProperty;var El=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var xl=Object.getPrototypeOf,Ol=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(l=l.concat([n.wrap(d,o,0),""]));let u=n.visibleArguments(e).map(g=>a...
...
L10: (Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidde
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1 1#!/usr/bin/env node
L2: "use strict";var kl=Object.create;var Br=Object.defineProperty;var El=Object.getOwnPropertyDescriptor;var Il=Object.getOwnPropertyNames;var xl=Object.getPrototypeOf,Ol=Object.proto...
L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(l=l.concat([n.wrap(d,o,0),""]));let u=n.visibleArguments(e).map(g=>a...
...
L10: (Did you mean one of ${r.join(", ")}?)`:r.length===1?`
L11: (Did you mean ${r[0]}?)`:""}Ni.suggestSimilar=Ll});var $i=q(Bi=>{var jl=require("node:events").EventEmitter,Yr=require("node:child_process"),$e=require("node:path"),zr=require("nod...
L12: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidde
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1