command-code@1.51.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

command-code@1.51.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = command-code@1.51.0 matchedIdentity = npm:Y29tbWFuZC1jb2Rl:1.51.0 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... `,LR=getMaxLineWidth(RR),OR=xR,DR=__name(e=>{const t=e??getTerminalWidth();return t>=MR?"full":t>=OR?"compact":"minimal"},"getHeaderLayout");new Set(["dark","light"]),Gt(),YI();var... This is an unexpected error. Please file a bug report at https://github.com/CommandCodeAI/command-code/issues/new`,error:e,skipTelemetry:!0,exit:!1}),shutdownTelemetry().finally(()...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L1

dist/index.mjsView file

1#!/usr/bin/env node L2: var e=Object.defineProperty,__name=(o,r)=>e(o,"name",{value:r,configurable:!0});function parseNodeMajor(e){const o=Number.parseInt(e.replace(/^v/,""),10);return Number.isFinite(o)?...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1

vsix/commandcode-vscode.vsixView file

•path = vsix/commandcode-vscode.vsix kind = high_entropy_blob sizeBytes = 3748632 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = compressed_blob sizeBytes = 3748632 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = nested_archive_needs_inspection sizeBytes = 3748632 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/commandcode-vscode.vsixView on unpkg

Source & flagged code

12 flagged

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = command-code@1.51.0 matchedIdentity = npm:Y29tbWFuZC1jb2Rl:1.51.0 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... `,LR=getMaxLineWidth(RR),OR=xR,DR=__name(e=>{const t=e??getTerminalWidth();return t>=MR?"full":t>=OR?"compact":"minimal"},"getHeaderLayout");new Set(["dark","light"]),Gt(),YI();var... This is an unexpected error. Please file a bug report at https://github.com/CommandCodeAI/command-code/issues/new`,error:e,skipTelemetry:!0,exit:!1}),shutdownTelemetry().finally(()...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L1

dist/index.mjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2var e=Object.defineProperty,__name=(o,r)=>e(o,"name",{value:r,configurable:!0});function parseNodeMajor(e){const

vsix/commandcode-vscode.vsixView file

•path = vsix/commandcode-vscode.vsix kind = high_entropy_blob sizeBytes = 3748632 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = compressed_blob sizeBytes = 3748632 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = nested_archive_needs_inspection sizeBytes = 3748632 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/commandcode-vscode.vsixView on unpkg