39092function wrapAnsi(string, columns, options) {
L39093: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n");
L39094: }
49593}
L49594: function powershellSnippet(agents) {
L49595: const dir = "$HOME\\.codev-hub\\bin";
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
delete opts.headers.authorization;
if (opts.auth && !options.headers.authorization) {
options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
Utils.prototype.writeFileToAsync = function(path, content, overwrite, attr, callback) {
filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
filetools.writeFileTo(target, content, overwrite, fileAttr);
filetools.writeFileTo(entryName, content, overwrite, fileAttr);
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
// node_modules/.pnpm/react@19.2.7/node_modules/react/cjs/react.production.js
"node_modules/.pnpm/react@19.2.7/node_modules/react/cjs/react.production.js"(exports2) {
// node_modules/.pnpm/react@19.2.7/node_modules/react/cjs/react.development.js
"node_modules/.pnpm/react@19.2.7/node_modules/react/cjs/react.development.js"(exports2, module2) {
"%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
"Invalid hook call. Hooks can only be called inside of the body of a function component. This could happen for one of th
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg 496"use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L496 34228opts.filename = input;
L34229: inBuffer = filetools.fs.readFileSync(input);
L34230: } else {
...
L34990: lines.push("");
L34991: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : "";
L34992: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :...
...
L39097: import process3 from "node:process";
L39098: import { execFileSync } from "node:child_process";
L39099: import fs from "node:fs";
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L34228 496Trigger-reachable persistence chain: scripts.start -> dist/index.js
L496: "use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L496 45719// src/lib/const.ts
L45720: var BASE_URL = atob("[redacted]=");
L45721: var BACKEND_URL = `${BASE_URL}/codev-backend`;
HighBase64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L45719 •matchType = normalized_sha256
matchedPackage = codev-ai@0.5.13
matchedPath = dist/index.js
matchedIdentity = npm:Y29kZXYtYWk:0.5.13
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg •matchType = malicious_source_fingerprint_signature
signature = 1c590807f64489fa
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = codev-ai@0.5.13
matchedPath = dist/index.js
matchedIdentity = npm:Y29kZXYtYWk:0.5.13
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkg 496"use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L496