open-walnut@0.4.5: Malicious npm security report (Block)

Loading npm security reports…

open-walnut@0.4.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

35 flagged

package.jsonView file

Lines 33-73json

33 "bin": {

34 "open-walnut": "./bin/open-walnut.js",

35 "walnut": "./bin/open-walnut.js"

36 },

37 "main": "./dist/cli.js",

38 "engines": {

39 "node": ">=22"

40 },

41 "files": [

42 "bin",

43 "dist",

44 "!dist/daemon-binaries/daemon-*",

45 "!dist/**/*.map",

46 "!dist/**/*.gz",

47 "patches",

48 "scripts/postinstall.mjs",

49 "README.md",

50 "LICENSE"

51 ],

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "prepublishOnly": "WALNUT_REQUIRE_BUN=1 npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

55 "prestart": "node scripts/check-node.mjs && node scripts/check-native-toolchain.mjs",

56 "start": "npm run web:build && node dist/cli.js web --port 3456",

57 "build:plugins": "npm run build -w @open-walnut/plugin-api && npm run build -w @open-walnut/plugin-cli",

58 "build": "npm run build:plugins && bash scripts/build-daemon.sh && tsup && rm -rf dist/data && cp -r src/data dist/ && for d in src/integrations/*/manifest.json; do cp \"$d\" \"dist/integrations/$(basename $(dirname $d))/\"; done && node scripts/ship-builtin-plugins.mjs",

59 "docs:check": "node scripts/generate-ops-docs.mjs --check --repo-only && node scripts/check-plugin-doc-snippets.mjs",

60 "test:plugin-packages": "npm run build:plugins && vitest run --config vitest.focus.config.ts tests/core/plugin-package-metadata.test.ts tests/core/plugin-cli-dev.test.ts tests/core/plugin-cli-scaffold.test.ts tests/core/plugin-publish-check.test.ts && node scripts/check-plugin-packages.mjs",

61 "dev": "tsup --watch",

62 "test": "node scripts/test-parallel.mjs",

63 "test:quick": "npm run docs:check && vitest run --config vitest.quick.config.ts",

64 "search:eval": "tsx scripts/search-eval.mjs",

65 "test:slow": "vitest run --config vitest.slow.config.ts",

66 "test:focus": "vitest run --config vitest.focus.config.ts",

67 "test:frontend:ci": "node scripts/test-frontend.mjs",

68 "test:changed": "node scripts/test-changed.mjs",

69 "test:baseline": "node scripts/test-baseline.mjs check",

70 "test:baseline:record": "node scripts/test-baseline.mjs record",

71 "test:pre-commit": "npm run docs:check && node scripts/test-changed.mjs --tiers",

72 "test:unit": "vitest run --config vitest.unit.config.ts",

73 "test:integration": "vitest run --config vitest.integration.config.ts",

dist/web/static/assets/index-CMqzxG_R.jsView file

352`))};if((jn.mac||jn.android)&&h.from==o-1&&/^\. ?$/.test(s.text)&&t.contentDOM.getAttribute("autocorrect")=="off"&&(h={from:a,to:c,insert:Rr.of([s.text.replace("."," ")])}),this.pe... L353: --؜‎‏\u2028\u2029‭‮⁦⁧⁩\uFEFF￹-]`,X5),kWe={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero w... L354: `&&(n="");else{let s=n.indexOf(`

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-CMqzxG_R.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

Lines 1104-1144javascript

1104

1105// src/utils/json-conflict-recovery.ts

1106import fsp2 from "fs/promises";

1107import path3 from "path";

1108import os2 from "os";

1109import

dist/web/static/assets/jszip.min-Dt3bmJZ8.jsView file

Lines 1-13javascript

1import{D as bt,F as It}from"./index-CMqzxG_R.js";function vt(yt){throw new Error('Could not dynamically require "'+yt+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.'

bin/open-walnut.jsView file

Lines 43-68javascript

43 || (!sub && (args.includes('--version') || args.includes('-V'))));

44// The import is the whole program, so its failure must be LOUD. Unhandled, a

45// bundle that is momentarily empty (dist rewritten by a concurrent build) made

46// the CLI exit 0 having printed nothing at all — a caller in a loop reads that as

47// "the command answered, with nothing", which is the worst possible answer.

dist/integrations/calendar/index.jsView file

Lines 1-38javascript

1// src/core/calendar/index.ts

2import { createHash as createHash2 } from "crypto";

4// src/core/event-bus.ts

5import { randomBytes } from "crypto";

7// src/logging/logger.ts

dist/cli.jsView file

99844import os18 from "os"; L99845: import http2 from "http"; L99846: import crypto23 from "crypto"; L99847: import net from "net"; L99848: import { spawn as spawn9, execFile as execFile16 } from "child_process"; L99849: function homeDir() { L99850: return process.env.WALNUT_HOME_OVERRIDE || process.env.HOME || os18.homedir(); L99851: }

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99844

26function apiBaseUrl() { L27: const raw = process.env.OPEN_WALNUT_API_URL?.trim(); L28: return (raw || DEFAULT_BASE_URL).replace(/\/+$/, ""); ... L34: try { L35: res = await fetch(base + path193, { L36: method, L37: ...body3 !== void 0 ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(body3) } : {}, L38: signal: AbortSignal.timeout(timeoutMs) ... L44: } L45: const text = res.status === 204 ? "" : await res.text(); L46: let parsed; ... L81: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

•Remote response is passed to a worker and executed with Node capabilities. dist/cli.js: function requireDirectRunners() { "WALNUT_CLI_DIRECT=1 requires the full CLI entry (dist/cli.js), which installs the direct runners. In tests, import ./direct-commands.js and call install() first." await requireDirectRunners().add(title, options, globals); await requireDirectRunners().tasks(options, globals); await requireDirectRunners().done(id, globals); await requireDirectRunners().recall(query, globals); await requireDirectRunners().projects(globals); await requireDirectRunners().sessions(globals); dist/cli.js: function requireDirectRunners() { "WALNUT_CLI_DIRECT=1 requires the full CLI entry (dist/cli.js), which installs the direct runners. In tests, import ./direct-commands.js and call install() f

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/web/server.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7680616 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/vscode-server-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/daemon-binaries/vscode-server-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/vscode-server-core.cjsView on unpkg

dist/hooks/on-stop.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/hooks/on-stop.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-stop.jsView on unpkg

dist/hooks/on-compact.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/hooks/on-compact.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-compact.jsView on unpkg

dist/integrations/jira/index.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/integrations/jira/index.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/jira/index.jsView on unpkg

dist/integrations/ms-todo/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ms-todo/index.jsView on unpkg

dist/cli-fast.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/cli-fast.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/daemon-binaries/acp-worker.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/integrations/walnut-time/dist/web.mjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/integrations/walnut-time/dist/web.mjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/walnut-time/dist/web.mjsView on unpkg

Source & flagged code

35 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/web/static/assets/index-CMqzxG_R.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-CMqzxG_R.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

1124var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L1125: var execAsync = promisify2(exec); L1126: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L1124

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = dist/workers/git-compaction-worker.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workers/git-compaction-worker.jsView on unpkg

dist/web/static/assets/jszip.min-Dt3bmJZ8.jsView file

11*/var zt;function Ot(){return zt||(zt=1,(function(yt,Rt){(function(b){yt.exports=b()})(function(){return(function b(U,k,l){function o(_,y){if(!k[_]){if(!U[_]){var p=typeof vt=="fun... L12: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(V.crc32,4),G+=l(V.compressedSize,4),G+=l(V.uncompressedSize,4),G+=l(L.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...

High

Eval

Package source references dynamic code evaluation.

dist/web/static/assets/jszip.min-Dt3bmJZ8.jsView on unpkg · L11

bin/open-walnut.jsView file

63} L64: import(entryPath.href).catch((err) => { L65: process.stderr.write(`walnut: cannot load ${entry}: ${err && err.message ? err.message : err}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/open-walnut.jsView on unpkg · L63

dist/integrations/calendar/index.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.4 matchedPath = [redacted].js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/calendar/index.jsView on unpkg

18var IS_EPHEMERAL = process.argv.includes("--_ephemeral-child"); L19: var CLOUD_MODE = process.env.WALNUT_CLOUD_MODE === "1"; L20: function resolveOpenWalnutHome() { L21: const envHome = process.env.OPEN_WALNUT_HOME; L22: const productionHome = path.join(os.homedir(), ".open-walnut"); L23: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L35: if (isEphemeralTmpDir(envHome)) { L36: process.stderr.write( L37: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L181: try { L182: const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8")); L183: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir, ".git")).isDirectory()) return dir;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/integrations/calendar/index.jsView on unpkg · L18

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99844

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7680616 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/vscode-server-core.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/vscode-server-core.cjsView on unpkg

dist/hooks/on-stop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-stop.jsView on unpkg

dist/hooks/on-compact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-compact.jsView on unpkg

dist/integrations/jira/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/jira/index.jsView on unpkg

dist/integrations/ms-todo/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ms-todo/index.jsView on unpkg

dist/cli-fast.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/integrations/walnut-time/dist/web.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/walnut-time/dist/web.mjsView on unpkg

Findings

4 Critical25 High8 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/web/static/assets/index-CMqzxG_R.js

HighShelldist/workers/git-compaction-worker.js

HighEvaldist/web/static/assets/jszip.min-Dt3bmJZ8.js

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighHidden Inline Dependency Executiondist/cli.js

HighRemote Agent Bridgedist/cli.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighSpawned Bundled Service Listenerdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighSemantic Analysis Limiteddist/cli.js

HighKnown Malware Source Similaritydist/daemon-binaries/vscode-server-core.cjs

HighKnown Malware Source Similaritydist/web/server.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/hooks/on-stop.js

HighKnown Malware Source Similaritydist/hooks/on-compact.js

HighKnown Malware Source Similaritydist/integrations/calendar/index.js

HighKnown Malware Source Similaritydist/integrations/jira/index.js

HighKnown Malware Source Similaritydist/integrations/ms-todo/index.js

HighKnown Malware Source Similaritydist/workers/git-compaction-worker.js

HighKnown Malware Source Similaritydist/cli-fast.js

HighKnown Malware Source Similaritydist/daemon-binaries/acp-worker.js

HighKnown Malware Source Similaritydist/integrations/walnut-time/dist/web.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/open-walnut.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/data/skills/walnut-register-repo/scripts/validate-repo.py

MediumOversized Source Filedist/web/server.js

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/integrations/calendar/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

35 flagged

package.jsonView file

Lines 33-73json

33 "bin": {

34 "open-walnut": "./bin/open-walnut.js",

35 "walnut": "./bin/open-walnut.js"

36 },

37 "main": "./dist/cli.js",

38 "engines": {

39 "node": ">=22"

40 },

41 "files": [

42 "bin",

43 "dist",

44 "!dist/daemon-binaries/daemon-*",

45 "!dist/**/*.map",

46 "!dist/**/*.gz",

47 "patches",

48 "scripts/postinstall.mjs",

49 "README.md",

50 "LICENSE"

51 ],

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "prepublishOnly": "WALNUT_REQUIRE_BUN=1 npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

55 "prestart": "node scripts/check-node.mjs && node scripts/check-native-toolchain.mjs",

56 "start": "npm run web:build && node dist/cli.js web --port 3456",

57 "build:plugins": "npm run build -w @open-walnut/plugin-api && npm run build -w @open-walnut/plugin-cli",

59 "docs:check": "node scripts/generate-ops-docs.mjs --check --repo-only && node scripts/check-plugin-doc-snippets.mjs",

61 "dev": "tsup --watch",

62 "test": "node scripts/test-parallel.mjs",

63 "test:quick": "npm run docs:check && vitest run --config vitest.quick.config.ts",

64 "search:eval": "tsx scripts/search-eval.mjs",

65 "test:slow": "vitest run --config vitest.slow.config.ts",

66 "test:focus": "vitest run --config vitest.focus.config.ts",

67 "test:frontend:ci": "node scripts/test-frontend.mjs",

68 "test:changed": "node scripts/test-changed.mjs",

69 "test:baseline": "node scripts/test-baseline.mjs check",

70 "test:baseline:record": "node scripts/test-baseline.mjs record",

71 "test:pre-commit": "npm run docs:check && node scripts/test-changed.mjs --tiers",

72 "test:unit": "vitest run --config vitest.unit.config.ts",

73 "test:integration": "vitest run --config vitest.integration.config.ts",

dist/web/static/assets/index-CMqzxG_R.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-CMqzxG_R.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

Lines 1104-1144javascript

1104

1105// src/utils/json-conflict-recovery.ts

1106import fsp2 from "fs/promises";

1107import path3 from "path";

1108import os2 from "os";

1109import

dist/web/static/assets/jszip.min-Dt3bmJZ8.jsView file

Lines 1-13javascript

bin/open-walnut.jsView file

Lines 43-68javascript

43 || (!sub && (args.includes('--version') || args.includes('-V'))));

44// The import is the whole program, so its failure must be LOUD. Unhandled, a

45// bundle that is momentarily empty (dist rewritten by a concurrent build) made

46// the CLI exit 0 having printed nothing at all — a caller in a loop reads that as

47// "the command answered, with nothing", which is the worst possible answer.

dist/integrations/calendar/index.jsView file

Lines 1-38javascript

1// src/core/calendar/index.ts

2import { createHash as createHash2 } from "crypto";

4// src/core/event-bus.ts

5import { randomBytes } from "crypto";

7// src/logging/logger.ts

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99844

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7680616 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/vscode-server-core.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/vscode-server-core.cjsView on unpkg

dist/hooks/on-stop.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-stop.jsView on unpkg

dist/hooks/on-compact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-compact.jsView on unpkg

dist/integrations/jira/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/jira/index.jsView on unpkg

dist/integrations/ms-todo/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ms-todo/index.jsView on unpkg

dist/cli-fast.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/integrations/walnut-time/dist/web.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/walnut-time/dist/web.mjsView on unpkg

open-walnut@0.4.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code