first-tree-staging@0.5.21-staging.1187.1: Clean npm security | LPM Firewall
Passed — safe to install
No malicious behavior detected. 22 low-signal pattern(s) reviewed.
registry /
first-tree-staging / 0.5.21-staging.1187.1
first-tree-staging@0.5.21-staging.1187.1 First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
scanned 6d ago · by lpm-firewall-ai No confirmed malicious attack surface. The install hook only prunes package-associated runtime artifacts on global installs; plugin setup is invoked through explicit CLI context setup.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Global npm installation; separately, user-invoked context setup/login commands.
Impact
Potential runtime footprint reduction; no confirmed exfiltration, remote payload execution, or unconsented agent-control hijack.
Mechanism
Scoped runtime-artifact pruning and explicit First Tree service/plugin operations.
Rationale
The lifecycle behavior is destructive but scoped to runtime dependencies on global installs and has no demonstrated malicious chain. Scanner claims of credential redirection and foreign-package overwrite are not supported by the inspected source.
Evidence
package.json scripts/prune-codex-runtime-binary.mjs dist/cli/index.mjs dist/connect-token-C9qruioV.mjs scripts/prune-claude-runtime-binary.mjs scripts/prune-claude-sdk-deps.mjs
public snapshot AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
postinstall runs three scripts that prune bundled AI runtime artifacts. Codex pruning removes resolved @openai/codex platform-package directories during global installs. Evidence against
The pruner exits for local installs and is limited to npm global installs. No credential harvesting or fixed unofficial credential gateway was found; login posts the supplied connect token to the selected server URL. Agent-plugin installation is an explicit `context` command flow with plan/confirmation checks. Behavioral surface
Source ChildProcess Crypto EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified UrlStrings
Manifest No manifest risk signals triggered.
scanned 12 file(s), 904 KB of source, external domains: github.com, gitlab.com, open.feishu.cn
Oversized source lightweight scan
dist/connect-token-C9qruioV.mjs 3.64 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Crypto Shell WebSocket HighEntropyStrings UrlStrings github.com
15 flagged · loading source • scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 9 import { createHash, randomBytes, randomUUID } from "node:crypto";
L10: import { execFileSync, spawn } from "node:child_process";
L11: import { createInterface } from "node:readline";
High Child Process
Package source references child process execution.
dist/cli/index.mjs View on unpkg · L9 7809 print.line(" If you need to restart the inline daemon:\n");
L7810: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`);
L7811: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);
• Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli/index.mjs:
import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS...
import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises";
* out of scope for this PR, tracked as follow-up #1069).
writeFileSync(descriptor, `${process.pid}\n`, "utf8");
writeFileSync(tempPath, stringify(validated), { mode: 384 });
writeFileSync(backupPath, originalBytes, {
writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 });
writeFileSync(launcherPath, materializedFile(name, readFileSync(launch
High Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli/index.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 18 Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 2 Critical 11 High 5 Medium 4 Low
Critical Credential Exfiltration dist/connect-token-C9qruioV.mjs
Critical Trigger Reachable Dangerous Capability dist/connect-token-C9qruioV.mjs
High Install Time Lifecycle Scripts package.json
High Child Process dist/cli/index.mjs
High Shell dist/cli/index.mjs
High Credential Redirect Persistence dist/connect-token-C9qruioV.mjs
High Entrypoint Foreign Package Code Overwrite dist/cli/index.mjs
High Command Output Exfiltration dist/connect-token-C9qruioV.mjs
High Trigger Reachable External Ai Agent Control Surface Mutation dist/connect-token-C9qruioV.mjs
High Trigger Reachable Credential Exfiltration dist/connect-token-C9qruioV.mjs
High Trigger Reachable Persistence dist/connect-token-C9qruioV.mjs
High Runtime Package Install dist/connect-token-C9qruioV.mjs
High Semantic Analysis Limited dist/connect-token-C9qruioV.mjs
Medium Ambiguous Install Lifecycle Script package.json
Medium Network
Medium Environment Vars
Medium Install Persistence dist/connect-token-C9qruioV.mjs
Medium Structural Risk Force Deep Review
Low Scripts Present
Low Filesystem
Low High Entropy Strings
Low Url Strings
LPM CLI
Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/connect-token-C9qruioV.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { createInterface } from "node:readline";
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
"authorization",
"*.authorization",
"*.headers.authorization"
const AUTHORIZATION_KEY = `["']?authorization["']?`;
const AUTHORIZATION_SCHEME_VALUE = `[A-Za-z][A-Za-z0-9_-]*\\s+[^\\s'"}]+|[^\\s,'"}]+`;
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/connect-token-C9qruioV.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 • Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
p failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`);
}
}
});
}
function freezeresult(resourceconfigversion, result) {
return object.freeze({
ok: result.failures.length === 0,
resourceconfigversion,
installed: object.freeze([...result.installed]),
skipped: object.freeze([...result.skipped]),
removed: object.freeze([...result.removed]),
teamskills: object.freeze([...result.teamskills]),
failures: object.freeze([...result.failures]),
staleteamsnapshot: result.staleteamsnapshot
});
}
function processmutexkey(workspace) {
try {
return realpathsync(resolve(workspace));
} catch {
return resolve(workspace);
}
}
async functio
High Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/connect-token-C9qruioV.mjs View on unpkg 18 Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 18 Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 96574 /**
L96575: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We
L96576: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact
...
L96579: * want to forward an attacker-controlled shell metacharacter from a
L96580: * (compromised) server welcome frame straight into `spawn`. spawn() already
L96581: * argv-escapes, but a `--registry=...` style spec would still be
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/connect-token-C9qruioV.mjs View on unpkg · L96574 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/connect-token-C9qruioV.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 15 flagged Lines 29-69 json
30 "context-integration" ,
32 "scripts/prune-codex-runtime-binary.mjs" ,
33 "scripts/prune-claude-runtime-binary.mjs" ,
34 "scripts/prune-claude-sdk-deps.mjs" ,
42 "dev" : "tsx src/cli/index.ts" ,
43 "build" : "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration" ,
44 "typecheck" : "tsc --noEmit" ,
45 "test" : "node scripts/run-vitest-batches.mjs" ,
46 "coverage" : "pnpm run build && vitest run --coverage --passWithNoTests" ,
47 "prepack" : "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare" ,
48 "postpack" : "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration" ,
49 "postinstall" : "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L49 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L49 51 "license" : "Apache-2.0" ,
52 "bundleDependencies" : [
53 "@botiverse/kimi-code-sdk"
57 "url" : "https://github.com/agent-team-foundation/first-tree.git" ,
58 "directory" : "apps/cli"
64 "@anthropic-ai/claude-agent-sdk" : "^0.3.187" ,
65 "@botiverse/kimi-code-sdk" : "0.26.0-botiverse.2" ,
66 "@antfu/utils" : "^9.3.0" ,
67 "@inquirer/prompts" : "^8.3.0" ,
68 "@openai/codex-sdk" : "^0.144.1" ,
69 "commander" : "^13.1.0" ,
9 import { createHash, randomBytes, randomUUID } from "node:crypto";
L10: import { execFileSync, spawn } from "node:child_process";
L11: import { createInterface } from "node:readline";
High Child Process
Package source references child process execution.
dist/cli/index.mjs View on unpkg · L9 7809 print.line(" If you need to restart the inline daemon:\n");
L7810: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`);
L7811: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);
• Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli/index.mjs:
import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS...
import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises";
* out of scope for this PR, tracked as follow-up #1069).
writeFileSync(descriptor, `${process.pid}\n`, "utf8");
writeFileSync(tempPath, stringify(validated), { mode: 384 });
writeFileSync(backupPath, originalBytes, {
writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 });
writeFileSync(launcherPath, materializedFile(name, readFileSync(launch
High Entrypoint Foreign Package Code Overwrite
18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 18 Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli/index.mjs
Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/connect-token-C9qruioV.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { createInterface } from "node:readline";
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
"authorization",
"*.authorization",
"*.headers.authorization"
const AUTHORIZATION_KEY = `["']?authorization["']?`;
const AUTHORIZATION_SCHEME_VALUE = `[A-Za-z][A-Za-z0-9_-]*\\s+[^\\s'"}]+|[^\\s,'"}]+`;
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/connect-token-C9qruioV.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 • Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
p failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`);
}
}
});
}
function freezeresult(resourceconfigversion, result) {
return object.freeze({
ok: result.failures.length === 0,
resourceconfigversion,
installed: object.freeze([...result.installed]),
skipped: object.freeze([...result.skipped]),
removed: object.freeze([...result.removed]),
teamskills: object.freeze([...result.teamskills]),
failures: object.freeze([...result.failures]),
staleteamsnapshot: result.staleteamsnapshot
});
}
function processmutexkey(workspace) {
try {
return realpathsync(resolve(workspace));
} catch {
return resolve(workspace);
}
}
async functio
High Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/connect-token-C9qruioV.mjs View on unpkg 18 Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 18 Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-C9qruioV.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/connect-token-C9qruioV.mjs View on unpkg · L18 96574 /**
L96575: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We
L96576: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact
...
L96579: * want to forward an attacker-controlled shell metacharacter from a
L96580: * (compromised) server welcome frame straight into `spawn`. spawn() already
L96581: * argv-escapes, but a `--registry=...` style spec would still be
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/connect-token-C9qruioV.mjs View on unpkg · L96574 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/connect-token-C9qruioV.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/connect-token-C9qruioV.mjs View on unpkg · L18