icoa-cli@2.19.480: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

icoa-cli@2.19.480: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

dist/repl.jsView file

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{dispatchable as n,helpRows as l,shortcutFor...

High

Child Process

Package source references child process execution.

dist/repl.jsView on unpkg · L1

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{dispatchable as n,helpRows as l,shortcutFor...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/repl.jsView on unpkg · L1

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{dispatchable as n,helpRows as l,shortcutFor...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/repl.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/repl.js L1: import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{dispatchable as n,helpRows as l,shortcutFor...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/repl.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/repl.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.jsView on unpkg

dist/commands/ctf4ai-demo.jsView file

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=-parseInt(U(0x17d))/(-0x170e+0x1701*0x1+0xe)*(parseInt(U(0x1a4))/(0x113c+-0x419+-0xd21))+parseInt(U(0x1da))/(0x89e+-0x2ae+-...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=-parseInt(U(0x17d))/(-0x170e+0x1701*0x1+0xe)*(parseInt(U(0x1a4))/(0x113c+-0x419+-0xd21))+parseInt(U(0x1da))/(0x89e+-0x2ae+-...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

dist/commands/env.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/env.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/env.jsView on unpkg

1import chalk from"chalk";import{execSync as e}from"node:child_process";import{appendFileSync as o,existsSync as n,mkdirSync as t,readFileSync as r}from"node:fs";import{homedir as a...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/env.jsView on unpkg · L1

dist/lib/tool-man.jsView file

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension li...

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/lib/tool-man.jsView on unpkg · L1

dist/commands/aienv.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/aienv.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/aienv.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg

dist/commands/learn.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/learn.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/learn.jsView on unpkg

Source & flagged code

13 flagged

dist/repl.jsView file

Lines 1-1javascript

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{dispatchable as n,helpRows as l,shortcutFor as a,subcommandsOf as s,surface as r}from"./lib/commands.js";import{distance as i}from"fastest-levenshtein";import{isConnected as c,getConfig as g,saveConfig as y}from"./lib/config.js";import{ensureLangCache as m}from"./lib/translations-fetcher.js";import{loadUiPack as d}from"./lib/i18n.js";import{isActivated as p,activateToken as u,isFreeCommand as h,isDeviceMatch as w,recordExit as f,recordResume as b,isFirstRunOr ...

High

Child Process

Package source references child process execution.

dist/repl.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/repl.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/repl.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/repl.jsView on unpkg · L1

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/repl.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.jsView on unpkg

dist/commands/ctf4ai-demo.jsView file

Lines 1-1javascript

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=-parseInt(U

dist/commands/env.jsView file

Lines 1-1javascript

1import chalk from"chalk";import{execSync as e}from"node:child_process";import{appendFileSync as o,existsSync as n,mkdirSync as t,readFileSync as r}from"node:fs";import{homedir as

dist/lib/tool-man.jsView file

Lines 1-1javascript

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension lies)"]]},{name:"strings",cat:"Forensics",summary:"pull printable text out of any binary"

dist/commands/aienv.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/aienv.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/aienv.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg

dist/commands/learn.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.478 matchedPath = dist/commands/learn.js matchedIdentity = npm:aWNvYS1jbGk:2.19.478 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/learn.jsView on unpkg