copilot-api-node20: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

copilot-api-node20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/main.mjsView file

1#!/usr/bin/env node L2: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Child Process

Package source references child process execution.

dist/main.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Shell

Package source references shell execution.

dist/main.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.mjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

1#!/usr/bin/env node L2: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/main.mjs L1: #!/usr/bin/env node L2: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/main.mjsView on unpkg · L1

Source & flagged code

6 flagged

dist/main.mjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:path";import{SpanKind as l,SpanStatusCode as c,context as u,metrics as p,trace as d}from"@opentelemetry/api";import m from"clipboardy";import{execFile as f,execSync as h}from"node:child_process";import g from"node:process";import{SeverityNumber as _,logs as y}from"@opentelemetry/api-logs";import{OTLPLogExporter as w}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPMetricExporter as k}from"@opentelemetry/exporter- ...

High

Child Process

Package source references child process execution.

dist/main.mjsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/main.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.mjsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/main.mjsView on unpkg · L1

Long lines were clipped for display.

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: import{defineCommand as e,runMain as t}from"citty";import o,{LogLevels as n,consola as r}from"consola";import a from"node:fs/promises";import i from"node:os";import s from"node:pat...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg