registry / drive-coding / 0.17.0

drive-coding@0.17.0

AI-powered coding assistant — single-command server + web UI for ACP coding agents

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Running the CLI starts a local coding-agent server and spawns OpenCode sessions. It injects the shipped prompt plugin into each spawned OpenCode process; the plugin alters system prompts. No install-time attack or unconsented foreign agent-config mutation was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `drive-coding` and creates an OpenCode agent session.

Impact

The package can influence spawned agent behavior and, if exposed beyond loopback or configured broadly, offers local filesystem browsing and credentialed TTS proxying.

Mechanism

Runtime OpenCode prompt-plugin injection through child-process environment configuration.

Rationale

Source inspection does not support a malicious verdict, but confirms a package-owned runtime agent-control capability that warrants warning under the stated policy. Scanner findings for bundled models, WASM, and minified frontend code do not establish malware.

Evidence

package.jsondist/drive-coding.jsplugins/prompt-injector.tsREADME.md

Network endpoints2

generativelanguage.googleapis.comapi.elevenlabs.io

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/drive-coding.js` spawns an OpenCode agent and injects a package plugin through `OPENCODE_CONFIG_CONTENT`.
`plugins/prompt-injector.ts` appends backend-supplied text to every OpenCode system prompt.
The plugin can write complete system prompts when `PROMPT_INJECTOR_DEBUG_PATH` is explicitly set.
`/api/fs/browse` can list filesystem paths; unrestricted unless `FS_BROWSE_ALLOWED_BASE` is configured.

Evidence against

`package.json` has no preinstall, install, or postinstall hook.
No source evidence of credential harvesting, remote payload download, shell-eval, or covert exfiltration.
The server defaults to loopback `127.0.0.1` and user-invoked CLI execution.
Agent configuration is supplied to the spawned child environment rather than mutating a foreign config file.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 2.34 MB of source, external domains: aiplatform.googleapis.com, api.elevenlabs.io, be.example.com, cdnjs.cloudflare.com, docs.cloud.google.com, docs.expo.dev, dummy.com, generativelanguage.googleapis.com, github.com, json-schema.org, opencode.ai, semver.org, svelte.dev, web.dev, www.w3.org

Oversized source lightweight scan

dist/drive-coding.js4.53 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoShellWebSocketHighEntropyStringsUrlStringsapi.elevenlabs.iogenerativelanguage.googleapis.comgithub.comjson-schema.orgopencode.ai

Source & flagged code

7 flagged

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView file

Lines 1-60javascript

1var so=Object.defineProperty;var oo=(e,n,t)=>n in e?so(e,n,{enumerable:!0,configurable:!0,writable:!0,value:t}):e[n]=t;var c=(e,n,t)=>oo(e,typeof n!="symbol"?n+"":n,t);const _e=e=>Array.isArray(e)?e:[e],ao=(e,n)=>{const t=[[],[]];for(const r of e)n(r)?t[0].push(r):t[1].push(r);return t},ni=Array,X=(e,n)=>e.includes(n),lo=(e,n=0)=>[...new Array(e)].map((t,r)=>r+n),N=(e,n,t)=>e===void 0?n===void 0?[]:Array.isArray(n)?n:[n]:(Array.isArray(n)?e.push(...n):e.push(n),e),fe=(e,n)=>n==null?e??[]:e==null?_e(n):e.concat(n),co=(...e)=>e.reduce(fe,[]),me=(e,n,t)=>{if(e===void 0)return Array.isArray(n)?n:[ ...

2 Message: ${r}

3 Source: (${e.slice(0,-1)}) => {

4 ${e[e.length-1]}

5 }`)}}};class ue{constructor(n,...[t]){return Object.assign(Object.setPrototypeOf(n.bind((t==null?void 0:t.bind)??this),this.constructor.prototype),t==null?void 0:t.attach)}}const qo=Ro(()=>{try{return new Function("return false")()}catch{return!0}});class Q{constructor(){}}const Co=()=>{var e,n,t;try{return(((t=(((n=(e=new Error().stack)==null?void 0:e.split(`

6`)[2])==null?void 0:n.trim())||"").match(/$?(.+?)(?::\d+:\d+)?$?$/))==null?void 0:t[1])||"unknown").replace(/^file:\/\//,"")}catch{return"unknown"}};var Ur;const Mo=((Ur=globalThis.process)==null?void 0:Ur.env)??{},Do={fileName:Co,env:Mo},Bo=e=>e[0].toUpperCase()+e.slice(1),Ko=e=>e[0].toLowerCase()+e.slice(1),hi=e=>new RegExp(zo(e),typeof e=="string"?"":e.flags),zo=e=>`^(?:${typeof e=="string"?e:e.source})$`,ae={negativeLookahead:e=>`(?!${e})`,nonCapturingGroup:e=>`(?:${e})`},je="\\",vt={" ":1,"\n":1," ":1},Eo=/^-0\.?0*$/.source,di=/[1-9]\d*/.source,Po=/\.\d+/.source,To=/\.\d*[1-9]/.source,p ...

7`+r);return n?`[

8${r}${o}

9${t}]`:`[${o}]`}const i=((s=e.constructor)==null?void 0:s.name)??"Object";if(i==="Object"){const o=ct(e).map(([a,l])=>{const u=typeof a=="symbol"?Oe.onSymbol(a):

10${o.join(`,

11`)}

12${t}}`:`{${o.join(", ")}}`}return e instanceof Date?He(e):"expression"in e&&typeof e.expression=="string"?e.expression:i},Oe={onCycle:()=>"(cycle)",onSymbol:e=>`Symbol(${Zt(e)})`,onFunction:

13`,this}const(t,r){return this.line(`const ${t} = ${r}`),this}let(t,r){return this.line(`let ${t} = ${r}`)}set(t,r){return this.line(`${t} = ${r}`)}if(t,r){return this.block(`if (${t})`,r)}elseIf(t,r){return this.block(`else if (${t})`,r)}else(t){return this.block("else",t)}for(t,r,i=0){return this.block(`for (let i = ${i}; ${t}; i++)`,r)}forIn(t,r){return this.block(`for (const k in ${t})`,r)}block(t,r,i=""){return this.line(`${t} {`),this.indent(),r(this),this.dedent(),this.line(`}${i}`)}return(t=""){return this.line(`return ${t}`)}write(t="anonymous",r=0){return`${t}(${this.argNames.join(

14`).map(i=>" ".repeat(r)+`${i}`).join(`

15`):this.body} }`}compile(){return new Oo(...this.argNames,this.body)}}const Ce=e=>ye(e,"object")||typeof e=="symbol"?F(e):yn(e),wi=(e,n=!1)=>typeof e=="string"&&Ue(e)?`${n?"?":""}.${e}`:vi

16`)}addAncestorPaths(t){for(const r of t.path.stringifyAncestors())this.byAncestorPath[r]=N(this.byAncestorPath[r],t)}}class ga extends Error{constructor(t){var n=(...Fd)=>(super(...Fd),c(this,"name","TraversalError"

17`+t.map(r=>` • ${ba(r)}`).join(`

18`)),Object.defineProperty(this,"arkErrors",{value:t,enumerable:!1})}}const ba=e=>e.toString().split(`

19`).join(`

20 `);class we{constructor(n,t){c(this,"path",[]);c(this,"errors",new ce(this));c(this,"root");c(this,"config");c(this,"queuedMorphs",[]);c(this

21• ${this.map(({path:n,l:t,r})=>`${n}: ${Hn(t,r)}`).join(`

22• `)}`}throw(){return f(this.describeReasons())}invert(){const n=this.map(t=>({...t,l:t.r,r:t.l}));return n instanceof y?n:new y(...n)}withPrefixKey(n,t){return this.map(r=>({...r,path:[n,...r.path],optional:r.optional||t==="optional"}))}toNeverIfDisjoint(){return g.intrinsic.never}}const Hn=(e,n)=>`${Yt(e)} and ${Yt(n)}`,Yt=e=>j(e)?e.expression:L(e)?e.map(Yt).join(" | ")||"never":String(e),Mi=e=>`${e} results in an unsatisfiable type`,xe={},re=(e,n,t)=>P(e,n,{$:t,invert:!1,pipe:!1}),Xt=(e,n,t)=>P(e,n,{$:t,invert:!1,pipe:!0}),P=((e,n,t)=>{const r=t.pipe?"|>":"&",i=`${e.hash}${r}${n.hash}`;if(x ...

23 ${l}

24`})}})),this);return this.$.finalize(r)}to(t){return this.$.finalize(this.toNode(this.$.parseDefinition(t)))}toNode(t){const r=Xt(this,t,this.$);return r instanceof y?r.throw():r}rawPipeOnce

25${e}`,Xn=(e,n)=>`${e} operand must be an object (was ${n})`,Qe=(e,n)=>R(xn(e),(t,r)=>[r,n]),bl=e=>typeof e=="string"?{reference:e}:e,er=e=>

26Seen: [${i.join("->")}]

27Resolution: ${I(r)}`)}get resolutionId(){if(this.reference.includes("&")||this.reference.includes("=>"))return this.resolution.id;if(this.reference[0]!=="$")return this.reference;const t=this.reference.slice(1),r=this.$.resolutions[t];return typeof r=="string"?r:k(r,"root")?r.id:B(`Unexpected resolution for reference ${this.reference}: ${I(r)}`)}get defaultShortDescription(){return ee.object}innerToJsonSchema(t){return this.resolution.toJsonSchemaRecurse(t)}compile(t){const r=this.resolutionId;t.if(`ctx.seen.${r} && ctx.seen.${r}.includes(data)`,()=>t.return(!0)),t.if(`!ctx.seen.${r}`,()=>t.li ...

28 ◦ `)}`,problem:e=>`(${e.actual}) must be...

29${e.expected}`},intersections:{intersection:(e,n,t)=>tr(e.inner,n.inner,t),...Qe("intersection",(e,n,t)=>{var l;if(e.children.length===0)return n;const{domain:r,proto:i,...s}=e.inner,o=i??r,a=o?P(o,n,t):n;return a instanceof y?a:(l=e==null?void 0:e.basis)!=null&&l.equals(a)?e:e.$.node("intersection",{...s,[a.kind]:a},{prereduced:!0})})}});class Sl extends We{constructor(){super(...arguments);c(this,"basis",this.inner.domain??this.inner.proto??null);c(this,"prestructurals",[]);c(this,"refinements",this.children.filter(t=>t.isRefinement()?(X(Ai,t.kind)&&this.prestructurals.push(t),!0):!1));c(thi ...

30Left: ${e}

31Right: ${n}`,Ol=M({kind:"proto",hasAssociatedError:!0,collapsibleKey:"proto",keys:{proto:{serialize:e=>gn(e)??ge(e)},dateAllowsInvalid:{}},normalize:e=>{const n=typeof e=="string"?{proto:Re[e]}:typeof e=="function"?j(e)?e:{proto:e}:typeof e.proto

32 code: "predicate",

33 expected: ${u},

34 actual: ${h},

35 relativePath: [${l}],

36 meta: ${this.compiledMeta}

37})`)}compileIndiscriminable(t){if(t.traversalKind==="Apply"){t.const("errors","[]");for(const r of this.branches)t.line("ctx.pushBranch()").line(t.invoke(r)).if("!ctx.hasError()",()=>t.return(r.includesTransform?"ctx.queuedMorphs.push(...ctx.popBranch().queuedMorphs)":"ctx.popBranch()")).line("errors.push(ctx.popBranch().error)");t.line(`ctx.errorFromNodeContext({ code: "union", errors, meta: ${this.compiledMeta} })`)}else{const{optimistic:r}=t;t.optimistic=!1;for(const i of this.branches)t.if(`${t.invoke(i)}`,()=>t.return(r?i.contextFreeMorph?`${F(i.contextFreeMorph)}(data)`:"data":!0));t.ret ...

38Left: ${e}

39Right: ${n}`,Jl=(e,n)=>`The intersection of two ordered unions is indeterminate:

40Left: ${e}

41Right: ${n}`,_l=M({kind:"unit",hasAssociatedError:!0,keys:{unit:{preserveUndefined:!0,serialize:e=>e instanceof Date?e.toISOString():ge(e)}},normalize:e=>e,defaults:{description:e=>I(e.unit),problem:({expected:e,actual:n

42${o},

Medium

Dynamic Require

Package source references dynamic require/import behavior.

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView on unpkg · L40

43`;if(!t.hasKind("union"))return a;const l=new Kt({kind:"Allows",optimistic:!0}).indent();t.compile(l);const u=l.write(`${t.id}Optimistic`);return`${a}${u},

44`},`{

45`)+"}");class ms{constructor(n,t){c(this,"config");c(this,"resolvedConfig");c(this,"name");c(this,"referencesById",{});c(this,"references",[]);c(this,"resolutions",{});c(this,"exportedNames",[]);c(this,"aliases",{});c(this,"resolved",!1);c(this,"nodesByHash",{});c(this,"intrinsic");c(this,"_json");c(this,"generic",(...n)=>{const t=this;return(r,i)=>new mt(n,i?new Di(r):r,t,t,i??null)});c(this,"units",(n,t)=>{const r=[];for(const s of n)r.includes(s)||r.push(s);const i=r.map(s=>this.node("unit",{unit:s},t));return this.node("union",i,{...t,prereduced:!0})});c(this,"lazyResolutions",[]);c(this," ...

46fn("string", ":", "number")(s => s.length)`;class ou extends ue{constructor(t){super((...r)=>new it(t)(...r),{bind:t});c(this,"$");this.$=t}in(t){return new it(this.$,t===void 0?void 0:this.$.parse(t))}at(t,r){return new it(this.$).at(t,r)}case(t,r){return new it(this.$).case(t,r)}}class it extends ue{constructor(t,r){super(i=>this.caseEntries(Object.entries(i).map(([s,o])=>s==="default"?[s,o]:[this.$.parse(s),o])));c(this,"$");c(this,"in");c(this,"key");c(this,"branches",[]);this.$=t,this.in=r}at(t,r){return this.key&&f(lu),this.branches.length&&f(au),this.key=t,r?this.match(r):this}case(t,r) ...

47]`).replace("lheading",Qs).replace("|table","").replace("blockquote"," {0,3}>").replace("|fences","").replace("|list","").replace("|html","").replace("|tag","").getRegex()},cd=/^\\(

48`),t=n.length-1;for(;t>=0&&T.blankLine.test(n[t]);)t--;return n.length-t<=2?e:n.slice(0,t+1).join(`

49`)}function Dd(e,n){if(e.indexOf(n[1])===-1)return-1;let t=0;for(let r=0;r<e.length;r++)if(e[r]==="\\")r++;else if(e[r]===n[0])t++;else if(e[r]===n[1]&&(t--,t<0))return r;return t>0?-2:-1}function Bd(e,n=0){let t=n,r="";for(let i of e)if(i===" "){let s=4-t%4;r+=" ".repeat(s),t+=s}else r+=i,t++;return r}function Fr(e,n,t,r,i){let s=n.href,o=n.title||null,a=e[1].replace(i.other.outputLinkReplace,"$1");r.state.inLink=!0;let l={type:e[0].charAt(0)==="!"?"image":"link",raw:t,href:s,title:o,text:a,tokens:r.inlineTokens(a)};return r.state.inLink=!1,l}function Kd(e,n,t){let r=e.match(t.other.indentCod ...

50`).map(s=>{let o=s.match(t.other.beginningSpace);if(o===null)return s;let[a]=o;return a.length>=i.length?s.slice(i.length):s}).join(`

51`)}var xt=class{constructor(e){c(this,"options");c(this,"rules");c(this,"lexer");this.options=e||ke}space(e){let n=this.rules.block.newline.exec(e);if(n&&n[0].length>0)return{type:"space",raw:n[0]}}code(e){let n=this.rules.block.code.exec(e);if(n){let t=this.options.pedantic?n[0]:jr(n[0]),r=t.replace(this.rules.other.codeRemoveIndent,"");return{type:"code",raw:t,codeBlockStyle:"indented",text:r}}}fences(e){let n=this.rules.block.fences.exec(e);if(n){let t=n[0],r=Kd(t,n[3]||"",this.rules);return{type:"code",raw:t,lang:n[2]?n[2].trim().replace(this.rules.inline.anyPunctuation,"$1"):n[2],text:r}} ...

52`),depth:n[1].length,text:t,tokens:this.lexer.inline(t)}}}hr(e){let n=this.rules.block.hr.exec(e);if(n)return{type:"hr",raw:se(n[0],`

53`)}}blockquote(e){let n=this.rules.block.blockquote.exec(e);if(n){let t=se(n[0],`

54`).split(`

55`),r="",i="",s=[];for(;t.length>0;){let o=!1,a=[],l;for(l=0;l<t.length;l++)if(this.rules.other.blockquoteStart.test(t[l]))a.push(t[l]),o=!0;else if(!o)a.

56`),h=u.replace(this.rules.other.blockquoteSetextReplace,`

57 $1`).replace(this.rules.other.blockquoteSetextReplace2,"");r=r?`${r}

58${u}`:u,i=i?`${i}

59${h}`:h;let d=this.lexer.state.top;if(this.lexer.state.top=!0,this.lexer.blockTokens(h,s,!0),this.lexer.state.top=d,t.length===0)break;let m=s.at(-1);if((m==null?void 0:

60`+t.join(`

Long lines were clipped for display.

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView file

42contains invisible/control Unicode U+202A (left-to-right embedding) Output ONLY the Hebrew sentence (no quotes, no markdown).`}const HN=/[.!?]\s*$|\n\s*$/;function ZN(t,e={}){const n=e.minChars??20,o=e.maxChars??200,i=e.locale??"he";if(t=t.replace(/[<U+200E><U+200F><U+202A>-<U+202E><U+2066>-<U+2069>]/g,""),

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView on unpkg · L42

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView file

•path = frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasm kind = wasm_module sizeBytes = 26239907 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView on unpkg

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView file

•path = frontend-dist/wake-word/models/hey_mycroft_v0.1.onnx kind = high_entropy_blob sizeBytes = 857691 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView on unpkg

dist/drive-coding.jsView file

•path = dist/drive-coding.js kind = oversized_source_file sizeBytes = 4752921 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/drive-coding.jsView on unpkg

•path = dist/drive-coding.js kind = oversized_cli_entrypoint sizeBytes = 4752921 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/drive-coding.jsView on unpkg

Source & flagged code

7 flagged · loading source

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView file

40Left: ${e} L41: Right: ${n}`,_l=M({kind:"unit",hasAssociatedError:!0,keys:{unit:{preserveUndefined:!0,serialize:e=>e instanceof Date?e.toISOString():ge(e)}},normalize:e=>e,defaults:{description:e=... L42: ${o},

Medium

Dynamic Require

Package source references dynamic require/import behavior.

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView on unpkg · L40

4${e[e.length-1]} L5: }`)}}};class ue{constructor(n,...[t]){return Object.assign(Object.setPrototypeOf(n.bind((t==null?void 0:t.bind)??this),this.constructor.prototype),t==null?void 0:t.attach)}}const q... L6: `)[2])==null?void 0:n.trim())||"").match(/$?(.+?)(?::\d+:\d+)?$?$/))==null?void 0:t[1])||"unknown").replace(/^file:\/\//,"")}catch{return"unknown"}};var Ur;const Mo=((Ur=globalTh...

Low

Eval

Package source references a known benign dynamic code generation pattern.

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView on unpkg · L4

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView on unpkg · L42

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView file

•path = frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasm kind = wasm_module sizeBytes = 26239907 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView on unpkg

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView file

•path = frontend-dist/wake-word/models/hey_mycroft_v0.1.onnx kind = high_entropy_blob sizeBytes = 857691 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView on unpkg

dist/drive-coding.jsView file

•path = dist/drive-coding.js kind = oversized_source_file sizeBytes = 4752921 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/drive-coding.jsView on unpkg

•path = dist/drive-coding.js kind = oversized_cli_entrypoint sizeBytes = 4752921 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/drive-coding.jsView on unpkg

Findings

1 Critical2 High7 Medium7 Low

CriticalTrojan Source Unicodefrontend-dist/_app/immutable/nodes/0.D_beALrd.js

HighShips High Entropy Blobfrontend-dist/wake-word/models/hey_mycroft_v0.1.onnx

HighOversized Source Filedist/drive-coding.js

MediumDynamic Requirefrontend-dist/_app/immutable/chunks/SrseV9LB.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Modulefrontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasm

MediumOversized Cli Entrypointdist/drive-coding.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalfrontend-dist/_app/immutable/chunks/SrseV9LB.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainersmusicode1

Version0.17.0

PublishedJul 11, 2026

LicenseMIT

Dependencies2

Integrityverified

Package size14.1 MB

Files117

Keywordsacpaicoding-agentvoice-firstcliopencodeclaude-codeself-hosted

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → drive-coding

RuntimeNo engine / OS / CPU constraints

Artifact39.9 MB · 117 files1 signature(s)

Install lifecycleNo install hooks · other: bundle, prepack

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStringsManifest: clean

Source & flagged code

7 flagged

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView file

Lines 1-60javascript

2 Message: ${r}

3 Source: (${e.slice(0,-1)}) => {

4 ${e[e.length-1]}

7`+r);return n?`[

8${r}${o}

9${t}]`:`[${o}]`}const i=((s=e.constructor)==null?void 0:s.name)??"Object";if(i==="Object"){const o=ct(e).map(([a,l])=>{const u=typeof a=="symbol"?Oe.onSymbol(a):

10${o.join(`,

11`)}

12${t}}`:`{${o.join(", ")}}`}return e instanceof Date?He(e):"expression"in e&&typeof e.expression=="string"?e.expression:i},Oe={onCycle:()=>"(cycle)",onSymbol:e=>`Symbol(${Zt(e)})`,onFunction:

14`).map(i=>" ".repeat(r)+`${i}`).join(`

15`):this.body} }`}compile(){return new Oo(...this.argNames,this.body)}}const Ce=e=>ye(e,"object")||typeof e=="symbol"?F(e):yn(e),wi=(e,n=!1)=>typeof e=="string"&&Ue(e)?`${n?"?":""}.${e}`:vi

17`+t.map(r=>` • ${ba(r)}`).join(`

18`)),Object.defineProperty(this,"arkErrors",{value:t,enumerable:!1})}}const ba=e=>e.toString().split(`

19`).join(`

20 `);class we{constructor(n,t){c(this,"path",[]);c(this,"errors",new ce(this));c(this,"root");c(this,"config");c(this,"queuedMorphs",[]);c(this

21• ${this.map(({path:n,l:t,r})=>`${n}: ${Hn(t,r)}`).join(`

23 ${l}

24`})}})),this);return this.$.finalize(r)}to(t){return this.$.finalize(this.toNode(this.$.parseDefinition(t)))}toNode(t){const r=Xt(this,t,this.$);return r instanceof y?r.throw():r}rawPipeOnce

25${e}`,Xn=(e,n)=>`${e} operand must be an object (was ${n})`,Qe=(e,n)=>R(xn(e),(t,r)=>[r,n]),bl=e=>typeof e=="string"?{reference:e}:e,er=e=>

26Seen: [${i.join("->")}]

28 ◦ `)}`,problem:e=>`(${e.actual}) must be...

30Left: ${e}

32 code: "predicate",

33 expected: ${u},

34 actual: ${h},

35 relativePath: [${l}],

36 meta: ${this.compiledMeta}

38Left: ${e}

39Right: ${n}`,Jl=(e,n)=>`The intersection of two ordered unions is indeterminate:

40Left: ${e}

42${o},

Medium

Dynamic Require

Package source references dynamic require/import behavior.

frontend-dist/_app/immutable/chunks/SrseV9LB.jsView on unpkg · L40

43`;if(!t.hasKind("union"))return a;const l=new Kt({kind:"Allows",optimistic:!0}).indent();t.compile(l);const u=l.write(`${t.id}Optimistic`);return`${a}${u},

44`},`{

47]`).replace("lheading",Qs).replace("|table","").replace("blockquote"," {0,3}>").replace("|fences","").replace("|list","").replace("|html","").replace("|tag","").getRegex()},cd=/^\\(

48`),t=n.length-1;for(;t>=0&&T.blankLine.test(n[t]);)t--;return n.length-t<=2?e:n.slice(0,t+1).join(`

50`).map(s=>{let o=s.match(t.other.beginningSpace);if(o===null)return s;let[a]=o;return a.length>=i.length?s.slice(i.length):s}).join(`

52`),depth:n[1].length,text:t,tokens:this.lexer.inline(t)}}}hr(e){let n=this.rules.block.hr.exec(e);if(n)return{type:"hr",raw:se(n[0],`

53`)}}blockquote(e){let n=this.rules.block.blockquote.exec(e);if(n){let t=se(n[0],`

54`).split(`

55`),r="",i="",s=[];for(;t.length>0;){let o=!1,a=[],l;for(l=0;l<t.length;l++)if(this.rules.other.blockquoteStart.test(t[l]))a.push(t[l]),o=!0;else if(!o)a.

56`),h=u.replace(this.rules.other.blockquoteSetextReplace,`

57 $1`).replace(this.rules.other.blockquoteSetextReplace2,"");r=r?`${r}

58${u}`:u,i=i?`${i}

59${h}`:h;let d=this.lexer.state.top;if(this.lexer.state.top=!0,this.lexer.blockTokens(h,s,!0),this.lexer.state.top=d,t.length===0)break;let m=s.at(-1);if((m==null?void 0:

60`+t.join(`

Long lines were clipped for display.

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

frontend-dist/_app/immutable/nodes/0.D_beALrd.jsView on unpkg · L42

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView file

•path = frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasm kind = wasm_module sizeBytes = 26239907 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

frontend-dist/_app/immutable/assets/ort-wasm-simd-threaded.jsep.CyqnNavA.wasmView on unpkg

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView file

•path = frontend-dist/wake-word/models/hey_mycroft_v0.1.onnx kind = high_entropy_blob sizeBytes = 857691 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

frontend-dist/wake-word/models/hey_mycroft_v0.1.onnxView on unpkg

dist/drive-coding.jsView file

•path = dist/drive-coding.js kind = oversized_source_file sizeBytes = 4752921 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/drive-coding.jsView on unpkg

•path = dist/drive-coding.js kind = oversized_cli_entrypoint sizeBytes = 4752921 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/drive-coding.jsView on unpkg