command-code@1.74.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

command-code@1.74.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/cli.mjsView file

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = command-code@1.73.4 matchedIdentity = npm:Y29tbWFuZC1jb2Rl:1.73.4 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... `,i$=getMaxLineWidth(s$),a$=n$,l$=__name(e=>{const t=e??getTerminalWidth();return t>=t$?"full":t>=a$?"compact":"minimal"},"getHeaderLayout");new Set(["dark","light"]),Vt(),eL();var... This is an unexpected error. Please file a bug report at https://github.com/CommandCodeAI/command-code/issues/new`,error:e,skipTelemetry:!0,exit:!1}),shutdownTelemetry().finally(()...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L1

dist/index.mjsView file

1#!/usr/bin/env node L2: var e=Object.defineProperty,__name=(o,r)=>e(o,"name",{value:r,configurable:!0});function parseNodeMajor(e){const o=Number.parseInt(e.replace(/^v/,""),10);return Number.isFinite(o)?...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1

vsix/commandcode-vscode.vsixView file

•path = vsix/commandcode-vscode.vsix kind = high_entropy_blob sizeBytes = 3756567 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = compressed_blob sizeBytes = 3756567 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = nested_archive_needs_inspection sizeBytes = 3756567 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/commandcode-vscode.vsixView on unpkg

Source & flagged code

15 flagged

dist/cli.mjsView file

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = command-code@1.73.4 matchedIdentity = npm:Y29tbWFuZC1jb2Rl:1.73.4 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... `,i$=getMaxLineWidth(s$),a$=n$,l$=__name(e=>{const t=e??getTerminalWidth();return t>=t$?"full":t>=a$?"compact":"minimal"},"getHeaderLayout");new Set(["dark","light"]),Vt(),eL();var... This is an unexpected error. Please file a bug report at https://github.com/CommandCodeAI/command-code/issues/new`,error:e,skipTelemetry:!0,exit:!1}),shutdownTelemetry().finally(()...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs L1: #!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.mjsView on unpkg

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as o,parse as r,resolve as s,relative as i,isAbsolute as a,sep as l,basename as c,extname as d,win32 as u,posix as m}from"path";i... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L1

dist/index.mjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2var e=Object.defineProperty,__name=(o,r)=>e(o,"name",{value:r,configurable:!0});function parseNodeMajor(e){const

vsix/commandcode-vscode.vsixView file

•path = vsix/commandcode-vscode.vsix kind = high_entropy_blob sizeBytes = 3756567 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = compressed_blob sizeBytes = 3756567 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = nested_archive_needs_inspection sizeBytes = 3756567 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/commandcode-vscode.vsixView on unpkg