first-tree-staging@0.5.21-staging.1198.1: Suspicious npm security | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
registry /
first-tree-staging / 0.5.21-staging.1198.1
first-tree-staging@0.5.21-staging.1198.1 First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
scanned 3d ago · by lpm-firewall-ai LPM treats this as warn-only first-party agent extension lifecycle risk. Install time deletes selected bundled SDK packages only for global installation. A separately invoked Context setup command can install this package's signed plugin payload into Codex or Claude Code user scope.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
`npm install -g` for pruning; explicit `first-tree context enable` with confirmation for plugin setup.
Impact
Can remove SDK-bundled runtime/dependency packages from First Tree's global installation and enable First Tree Context hooks after user approval.
Mechanism
guarded global dependency pruning and consented first-party agent-plugin installation
Rationale
The scanner's credential-redirection claim is not supported by the inspected source. The remaining guarded lifecycle and explicit agent-plugin setup behavior warrants a warning rather than a block.
Evidence
package.json scripts/prune-codex-runtime-binary.mjs dist/cli/index.mjs context-integration/codex/plugins/first-tree-context/hooks/hooks.json scripts/prune-claude-runtime-binary.mjs scripts/prune-claude-sdk-deps.mjs
public snapshot
AI called this Suspicious at 83.0% confidence as Dangerous Capability
low
Evidence for warning
postinstall runs three pruning scripts. Global-install postinstall recursively removes @openai/codex platform packages. Explicit `context enable` installs a First Tree plugin into Codex/Claude user scope. Evidence against
Pruning is gated on `npm_config_global === "true"`; ordinary dependency installs return first. Context enable requires a plan and interactive confirmation or `--yes`. No source evidence of credential harvesting, fixed unofficial credential gateway, or install-time network activity. Behavioral surface
Source ChildProcess Crypto EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified UrlStrings
Manifest No manifest risk signals triggered.
scanned 12 file(s), 916 KB of source, external domains: github.com, gitlab.com, open.feishu.cn
Oversized source lightweight scan
dist/connect-token-BXEAr_r0.mjs 3.74 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Crypto Shell WebSocket HighEntropyStrings UrlStrings github.com
16 flagged · loading source • scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = first-tree-staging@0.5.21-staging.1194.1
matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.21-staging.1194.1
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/index.mjs View on unpkg 9 import { createHash, randomBytes, randomUUID } from "node:crypto";
L10: import { execFileSync, spawn } from "node:child_process";
L11: import { createInterface } from "node:readline";
High Child Process
Package source references child process execution.
dist/cli/index.mjs View on unpkg · L9 9130 print.line(" If you need to restart the inline daemon:\n");
L9131: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`);
L9132: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);
• Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli/index.mjs:
import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS...
import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises";
* out of scope for this PR, tracked as follow-up #1069).
writeFileSync(descriptor, `${process.pid}\n`, "utf8");
writeFileSync(tempPath, stringify(validated), { mode: 384 });
writeFileSync(backupPath, originalBytes, {
writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 });
writeFileSync(launcherPath, materializedFile(name, readFileSync(launch
High Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli/index.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 18 Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 3 Critical 11 High 5 Medium 4 Low
Critical Credential Exfiltration dist/connect-token-BXEAr_r0.mjs
Critical Trigger Reachable Dangerous Capability dist/connect-token-BXEAr_r0.mjs
Critical Previous Version Dangerous Delta dist/cli/index.mjs
High Install Time Lifecycle Scripts package.json
High Child Process dist/cli/index.mjs
High Shell dist/cli/index.mjs
High Credential Redirect Persistence dist/connect-token-BXEAr_r0.mjs
High Entrypoint Foreign Package Code Overwrite dist/cli/index.mjs
High Command Output Exfiltration dist/connect-token-BXEAr_r0.mjs
High Trigger Reachable External Ai Agent Control Surface Mutation dist/connect-token-BXEAr_r0.mjs
High Trigger Reachable Credential Exfiltration dist/connect-token-BXEAr_r0.mjs
High Trigger Reachable Persistence dist/connect-token-BXEAr_r0.mjs
High Runtime Package Install dist/connect-token-BXEAr_r0.mjs
High Semantic Analysis Limited dist/connect-token-BXEAr_r0.mjs
Medium Ambiguous Install Lifecycle Script package.json
Medium Network
Medium Environment Vars
Medium Install Persistence dist/connect-token-BXEAr_r0.mjs
Medium Structural Risk Force Deep Review
Low Scripts Present
Low Filesystem
Low High Entropy Strings
Low Url Strings
LPM CLI
Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/connect-token-BXEAr_r0.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { createInterface } from "node:readline";
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
"authorization",
"*.authorization",
"*.headers.authorization"
const AUTHORIZATION_KEY = `["']?authorization["']?`;
const AUTHORIZATION_SCHEME_VALUE = `[A-Za-z][A-Za-z0-9_-]*\\s+[^\\s'"}]+|[^\\s,'"}]+`;
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 • Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
p failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`);
}
}
});
}
function freezeresult(resourceconfigversion, result) {
return object.freeze({
ok: result.failures.length === 0,
resourceconfigversion,
installed: object.freeze([...result.installed]),
skipped: object.freeze([...result.skipped]),
removed: object.freeze([...result.removed]),
teamskills: object.freeze([...result.teamskills]),
failures: object.freeze([...result.failures]),
staleteamsnapshot: result.staleteamsnapshot
});
}
function processmutexkey(workspace) {
try {
return realpathsync(resolve(workspace));
} catch {
return resolve(workspace);
}
}
async functio
High Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 18 Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 98857 /**
L98858: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We
L98859: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact
...
L98862: * want to forward an attacker-controlled shell metacharacter from a
L98863: * (compromised) server welcome frame straight into `spawn`. spawn() already
L98864: * argv-escapes, but a `--registry=...` style spec would still be
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L98857 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 16 flagged Lines 29-69 json
30 "context-integration" ,
32 "scripts/prune-codex-runtime-binary.mjs" ,
33 "scripts/prune-claude-runtime-binary.mjs" ,
34 "scripts/prune-claude-sdk-deps.mjs" ,
42 "dev" : "tsx src/cli/index.ts" ,
43 "build" : "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration" ,
44 "typecheck" : "tsc --noEmit" ,
45 "test" : "node scripts/run-vitest-batches.mjs" ,
46 "coverage" : "pnpm run build && vitest run --coverage --passWithNoTests" ,
47 "prepack" : "node ../../scripts/copy-skill-payloads.mjs --target skills --clean && node scripts/materialize-bundled-deps.mjs prepare" ,
48 "postpack" : "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration" ,
49 "postinstall" : "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L49 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L49 51 "license" : "Apache-2.0" ,
52 "bundleDependencies" : [
53 "@botiverse/kimi-code-sdk"
57 "url" : "https://github.com/agent-team-foundation/first-tree.git" ,
58 "directory" : "apps/cli"
64 "@anthropic-ai/claude-agent-sdk" : "^0.3.187" ,
65 "@botiverse/kimi-code-sdk" : "0.26.0-botiverse.2" ,
66 "@antfu/utils" : "^9.3.0" ,
67 "@inquirer/prompts" : "^8.3.0" ,
68 "@openai/codex-sdk" : "^0.144.1" ,
69 "commander" : "^13.1.0" ,
• matchType = previous_version_dangerous_delta
matchedPackage = first-tree-staging@0.5.21-staging.1194.1
matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.21-staging.1194.1
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/index.mjs View on unpkg 9 import { createHash, randomBytes, randomUUID } from "node:crypto";
L10: import { execFileSync, spawn } from "node:child_process";
L11: import { createInterface } from "node:readline";
High Child Process
Package source references child process execution.
dist/cli/index.mjs View on unpkg · L9 9130 print.line(" If you need to restart the inline daemon:\n");
L9131: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`);
L9132: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);
18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 18 Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/cli/index.mjs:
import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS...
import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises";
* out of scope for this PR, tracked as follow-up #1069).
writeFileSync(descriptor, `${process.pid}\n`, "utf8");
writeFileSync(tempPath, stringify(validated), { mode: 384 });
writeFileSync(backupPath, originalBytes, {
writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 });
writeFileSync(launcherPath, materializedFile(name, readFileSync(launch
High Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/cli/index.mjs View on unpkg Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/connect-token-BXEAr_r0.mjs:
import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
import { createInterface } from "node:readline";
import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
"authorization",
"*.authorization",
"*.headers.authorization"
const AUTHORIZATION_KEY = `["']?authorization["']?`;
const AUTHORIZATION_SCHEME_VALUE = `[A-Za-z][A-Za-z0-9_-]*\\s+[^\\s'"}]+|[^\\s,'"}]+`;
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 • Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
p failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`);
}
}
});
}
function freezeresult(resourceconfigversion, result) {
return object.freeze({
ok: result.failures.length === 0,
resourceconfigversion,
installed: object.freeze([...result.installed]),
skipped: object.freeze([...result.skipped]),
removed: object.freeze([...result.removed]),
teamskills: object.freeze([...result.teamskills]),
failures: object.freeze([...result.failures]),
staleteamsnapshot: result.staleteamsnapshot
});
}
function processmutexkey(workspace) {
try {
return realpathsync(resolve(workspace));
} catch {
return resolve(workspace);
}
}
async functio
High Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 18 Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BXEAr_r0.mjs
L18: import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18 98857 /**
L98858: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We
L98859: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact
...
L98862: * want to forward an attacker-controlled shell metacharacter from a
L98863: * (compromised) server welcome frame straight into `spawn`. spawn() already
L98864: * argv-escapes, but a `--registry=...` style spec would still be
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L98857 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/connect-token-BXEAr_r0.mjs View on unpkg 18 import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/connect-token-BXEAr_r0.mjs View on unpkg · L18