codebolt@1.12.79
⚠ Under reviewCodeBolt headless server CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 21 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
NoLicenseWildcardDependency
Oversized source lightweight scan
dist/assets/capabilities/executors/skill-executor/dist/index.js3.36 MB file, sampled 256 KB
Source & flagged code
9 flaggeddist/web/assets/serverWorkerMain-CPdrTHxh.jsView file
2patternName = generic_password
severity = medium
line = 2
matchedText = var serv...)();
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L21/*! For license information please see serverWorkerMain.js.LICENSE.txt */
L2: var serverExportVar;(()=>{var e={3608:(e,t,r)=>{"use strict";var n;function i(e){if("contents"in e)n="string"==typeof e.contents?JSON.parse(e.contents):e.contents;else if("fsPath"i...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L1dist/web/assets/extension-BZwOPnR9.jsView file
1/*! For license information please see extension.js.LICENSE.txt */
L2: (()=>{var e={956:(e,t,n)=>{"use strict";n.r(t),n.d(t,{ActiveStatus:()=>D.f,AppInsightsCore:()=>m,BaseTelemetryPlugin:()=>R.s,DiagnosticLogger:()=>l.wq,EventLatency:()=>h,EventPersi...
L3: //# sourceMappingURL=https://main.vscode-cdn.[redacted]-language-features/dist/browser/extension.js.map
Findings
1 Critical3 High9 Medium8 Low
CriticalTrojan Source Unicodedist/web/assets/iconv-lite-umd-DpoLQuPU.js
HighSemantic Analysis Limiteddist/web/assets/elk.bundled-DED6nYWl.js
HighKnown Malware Source Similaritydist/web/assets/sql-D0XecflT.js
HighKnown Malware Source Similaritydist/web/assets/vbscript-BuJXcnF6.js
MediumSecret Patterndist/web/assets/serverWorkerMain-CPdrTHxh.js
MediumDynamic Requiredist/web/assets/extension-BZwOPnR9.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Wasm Moduledist/web/assets/onig-Du5pRr7Y.wasm
MediumOversized Source Filedist/web/assets/vendor-monaco-7uIto7rp.js
Medium
Affected versions and remediation
This report applies to codebolt@1.12.79.
See all versions of codebolt for other recorded verdicts.
- Review the evidence and your use of codebolt@1.12.79 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.