18import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18 18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-Dd2vvd88.mjs
L18: import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18 22import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
HighChild Process
Package source references child process execution.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L22 21758process.argv[0],
L21759: ...process.execArgv,
L21760: ...process.argv.slice(1)
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/connect-token-Dd2vvd88.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { createInterface } from "node:readline";
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
"authorization",
"*.authorization",
"*.headers.authorization"
* Named constants for call sites that prefer `RUNTIME_PROVIDERS.CODEX` over
connectBootstrap: { portableDownloadBaseUrl: field$1(z.string().
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/connect-token-Dd2vvd88.mjsView on unpkg •Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/connect-token-Dd2vvd88.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
connectBootstrap: { portableDownloadBaseUrl: field$1(z.string().url().default("https://download.first-tree.ai/releases"), { env: "FIRST_TREE_PORTABLE_DOWNLOAD_BASE_URL" }) },
registryUrl: field$1(z.string().url().default("https://registry.npmjs.org"), { env: "FIRST_TREE_U
HighEntrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/connect-token-Dd2vvd88.mjsView on unpkg 18import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18 •Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
p failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`);
}
}
});
}
function freezeresult(resourceconfigversion, result) {
return object.freeze({
ok: result.failures.length === 0,
resourceconfigversion,
installed: object.freeze([...result.installed]),
skipped: object.freeze([...result.skipped]),
removed: object.freeze([...result.removed]),
teamskills: object.freeze([...result.teamskills]),
failures: object.freeze([...result.failures]),
staleteamsnapshot: result.staleteamsnapshot
});
}
function processmutexkey(workspace) {
try {
return realpathsync(resolve(workspace));
} catch {
return resolve(workspace);
}
}
async functio
HighTrigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/connect-token-Dd2vvd88.mjsView on unpkg 18Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-Dd2vvd88.mjs
L18: import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18 18Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-Dd2vvd88.mjs
L18: import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
HighTrigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18 95865/**
L95866: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We
L95867: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact
...
L95870: * want to forward an attacker-controlled shell metacharacter from a
L95871: * (compromised) server welcome frame straight into `spawn`. spawn() already
L95872: * argv-escapes, but a `--registry=...` style spec would still be
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L95865 •stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
HighSemantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/connect-token-Dd2vvd88.mjsView on unpkg 18import { URL as URL$1 } from "url";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L144: function formatPrettyEntry(json) {
L145: const obj = JSON.parse(json);
L146: const level = obj.level;
...
L169: function createLoggerOutputStream(options) {
L170: const getDest = options.getDestination ?? (() => process.stderr);
L171: return new Writable({ write(chunk, _, callback) {
MediumInstall Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/connect-token-Dd2vvd88.mjsView on unpkg · L18