flavor-code@1.3.4
<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package-generated default directs OAuth login exchange material to a fixed private-network recipient unrelated to the configured Anthropic provider. User invocation controls when the flow runs, but does not establish consent to send the exchange material to that recipient.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user initializes a project and then starts OAuth login using the generated provider configuration.
Impact
The fixed recipient can receive OAuth exchange material for the account being authenticated.
Mechanism
The login flow builds authorization against the configured host, receives an authorization code, and posts the code and verifier to the configured token endpoint.
Attack narrative
The CLI initialization path writes a default provider whose OAuth authorization and token endpoints use a fixed private-network host. When the user later logs in with that configuration, the package sends the returned authorization code and verifier to that host. The source does not establish recipient-specific consent for sending login material there.
AI rationale
The package-generated default directs OAuth login exchange material to a fixed private-network recipient unrelated to the configured Anthropic provider. User invocation controls when the flow runs, but does not establish consent to send the exchange material to that recipient.
Evidence
package.jsondist/cli.jsdist/desktop/main.js
Network endpoints2
192.168.1.100:8091/authorize192.168.1.100:8091/token
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI initialization command and a desktop main entrypoint.
- Initialization writes a default OAuth provider that directs authorization and token exchange to a fixed private-network host.
- The login flow uses the configured provider and constructs an authorization URL for that host.
- The flow sends the returned authorization code and verifier to the configured token URL.
- The vendor parser uses generated embedded assembly code in its runtime; that separate eval match does not account for the OAuth behavior.
Evidence against
- The default configuration is created when the user invokes initialization, and the exchange requires a subsequent login flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
14 flagged · loading sourcedist/chunk-F2HMO5Q2.jsView file
27059function wrapAnsi(string, columns, options) {
L27060: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs2(line), columns, options)).join("\n");
L27061: }
High
Child Process
Package source references child process execution.
dist/chunk-F2HMO5Q2.jsView on unpkg · L27059dist/desktop/main.jsView file
7215}
L7216: if (["powershell", "pwsh"].includes(name)) {
L7217: const flag = args.findIndex((arg) => ["-command", "-c"].includes(arg.toLowerCase()));
High
8587function runShellHandler(descriptor, event, signal) {
L8588: return new Promise((resolve41, reject) => {
L8589: const child = spawn(descriptor.command, [...descriptor.args ?? []], {
L8590: env: { ...process.env, ...descriptor.env },
L8591: shell: false,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/desktop/main.jsView on unpkg · L8587•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/desktop/main.js:
import { readFile as readFile39, stat as stat18, writeFile as writeFile19 } from "fs/promises";
baseURL: z.string().trim().url().max(2048).refine((value) => {
baseURL: z2.string().url().optional(),
authorizationUrl: z2.string().url().optional(),
await handle.writeFile(data2);
baseURL: HttpUrlInput,
async function runInteractionManifest(manifest, baseUrl, createDriver) {
if (!isLoopbackPreviewUrl(baseUrl)) throw new Error("D2C interaction preview must use a loopback HTTP URL");
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/desktop/main.jsView on unpkg8626if (code !== 0) {
L8627: reject(new Error(`Shell hook exited with code ${code}: ${stderr.trim()}`));
L8628: return;
...
L8630: try {
L8631: resolve41(HookDecisionSchema.parse(JSON.parse(stdout)));
L8632: } catch (error) {
...
L8635: });
L8636: child.stdin.end(JSON.stringify(event));
L8637: });
...
L8641: if (process.platform === "win32") {
L8642: const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
L8643: stdio: "ignore",
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/desktop/main.jsView on unpkg · L86268626Trigger-reachable command-output exfiltration chain: manifest.main -> dist/desktop/main.js
L8626: if (code !== 0) {
L8627: reject(new Error(`Shell hook exited with code ${code}: ${stderr.trim()}`));
L8628: return;
...
L8630: try {
L8631: resolve41(HookDecisionSchema.parse(JSON.parse(stdout)));
L8632: } catch (error) {
...
L8635: });
L8636: child.stdin.end(JSON.stringify(event));
L8637: });
...
L8641: if (process.platform === "win32") {
L8642: const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
L8643: stdio: "ignore",
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/desktop/main.jsView on unpkg · L86264import { readFile as readFile39, stat as stat18, writeFile as writeFile19 } from "fs/promises";
L5: import { basename as basename11, dirname as dirname24, join as join46, resolve as resolve40 } from "path";
L6: import { fileURLToPath as fileURLToPath4 } from "url";
...
L46: try {
L47: parsed = JSON.parse(unfenced);
L48: } catch {
...
L401: }
L402: return { ...input, data: data2 };
L403: }
...
L1133: const onRenderProcessGone = (_event, details) => {
L1134: recordRendererDiagnostic(`renderer process ${details.reason} (exit ${details.exitCode})`);
L1135: };
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/desktop/main.jsView on unpkg · L4dist/astgraph/vendor/tree-sitter.jsView file
2977var func = `(${args}) => { ${body} };`;
L2978: ASM_CONSTS[start] = eval(func);
L2979: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/astgraph/vendor/tree-sitter.jsView on unpkg · L2977dist/astgraph/index.jsView file
29async function mod(name) {
L30: return import(new URL(`./${name}`, import.meta.url).href);
L31: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/astgraph/index.jsView on unpkg · L29dist/desktop/plugin-worker-entry.jsView file
28const signal = Object.freeze({ aborted: false, reason: undefined, addEventListener() {}, removeEventListener() {}, throwIfAborted() {} });
L29: const cloneJson = (value) => value === undefined ? undefined : JSON.parse(JSON.stringify(value));
L30: const deepFreeze = (value) => {
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
dist/desktop/plugin-worker-entry.jsView on unpkg · L28dist/astgraph/vendor/tree-sitter.wasmView file
•path = dist/astgraph/vendor/tree-sitter.wasm
kind = wasm_module
sizeBytes = 205488
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
dist/astgraph/vendor/tree-sitter.wasmView on unpkgdist/astgraph/vendor/zod/v4/core/util.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/astgraph/vendor/zod/v4/core/util.js#virtual:normalized:round1View on unpkgdist/chunk-RQTYHUMK.jsView file
•matchType = normalized_sha256
matchedPackage = flavor-code@1.3.20
matchedPath = dist/chunk-RQTYHUMK.js
matchedIdentity = npm:Zmxhdm9yLWNvZGU:1.3.20
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/chunk-RQTYHUMK.jsView on unpkgdist/chunk-YKSMZDUZ.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = flavor-code@1.4.1
matchedIdentity = npm:Zmxhdm9yLWNvZGU:1.4.1
similarity = 0.478
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-YKSMZDUZ.jsView on unpkgFindings
1 Critical8 High6 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-YKSMZDUZ.js
HighChild Processdist/chunk-F2HMO5Q2.js
HighShelldist/desktop/main.js
HighSame File Env Network Executiondist/desktop/main.js
HighCredential Redirect Persistencedist/desktop/main.js
HighCommand Output Exfiltrationdist/desktop/main.js
HighTrigger Reachable Command Output Exfiltrationdist/desktop/main.js
HighSemantic Analysis Limiteddist/astgraph/vendor/zod/v4/core/util.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/chunk-RQTYHUMK.js
MediumDynamic Requiredist/astgraph/index.js
MediumUnsafe Vm Contextdist/desktop/plugin-worker-entry.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/astgraph/vendor/tree-sitter.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/astgraph/vendor/tree-sitter.js
LowWeak Cryptodist/desktop/main.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to flavor-code@1.3.4.
See all versions of flavor-code for other recorded verdicts.
- Avoid installing flavor-code@1.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.