39865function wrapAnsi(string, columns, options) {
L39866: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n");
L39867: }
50478}
L50479: function powershellSnippet(agents) {
L50480: const dir = "$HOME\\.codev-hub\\bin";
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
delete opts.headers.authorization;
if (opts.auth && !options.headers.authorization) {
options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
Utils.prototype.writeFileToAsync = function(path, content, overwrite, attr, callback) {
filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
filetools.writeFileTo(target, content, overwrite, fileAttr);
filetools.writeFileTo(entryName, content, overwrite, fileAttr);
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 496"use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L496 35001opts.filename = input;
L35002: inBuffer = filetools.fs.readFileSync(input);
L35003: } else {
...
L35763: lines.push("");
L35764: const baseUrlTag = session.baseUrl ? ` base_url=${session.baseUrl}` : "";
L35765: const subagentTag = session.subagentCharsIn || session.subagentCharsOut ? ` subagent_chars_in=${session.subagentCharsIn ?? 0} subagent_chars_out=${session.subagentCharsOut ?? 0}` :...
...
L39870: import process3 from "node:process";
L39871: import { execFileSync } from "node:child_process";
L39872: import fs from "node:fs";
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L35001 496Trigger-reachable persistence chain: scripts.start -> dist/index.js
L496: "use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L496 46493// src/lib/const.ts
L46494: var BASE_URL = atob("[redacted]=");
L46495: var BACKEND_URL = process.env.CODEV_BACKEND_URL || `${BASE_URL}/codev-backend`;
HighBase64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L46493 •matchType = normalized_sha256
matchedPackage = codev-ai@0.6.3
matchedPath = dist/index.js
matchedIdentity = npm:Y29kZXYtYWk:0.6.3
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg •matchType = malicious_source_fingerprint_signature
signature = 1c590807f64489fa
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = codev-ai@0.6.3
matchedPath = dist/index.js
matchedIdentity = npm:Y29kZXYtYWk:0.6.3
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkg 496"use strict";
L497: "production" !== process.env.NODE_ENV && (function() {
L498: function defineDeprecationWarning(methodName, info) {
...
L635: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L636: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L637: displayName
...
L1486: ];
L1487: if (process.platform !== "win32") {
L1488: module2.exports.push(
...
L1634: }
L1635: process14.exitCode = code || /* istanbul ignore next */
L1636: 0;
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L496