Loading npm security reports…

ozaiya-cli@0.11.25: Suspicious npm security report (Warn) | LPM Firewall

registry / ozaiya-cli / 0.11.25

ozaiya-cli@0.11.25

Ozaiya agent daemon - server management and terminal

AI Security Review

scanned 12d ago · by lpm-firewall-ai

When the Ozaiya daemon starts, it copies local Claude, Codex, and Gemini session credentials into provider records and includes those records in daemon state sent to the configured server. The server host defaults to api.ozaiya.com and can be replaced by OZAIYA_SERVER_URL with no allowlist, so the tokens are not bound to Anthropic, OpenAI, or Google.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the ozaiya daemon start path, which connects the machine client and calls provider detection.

Impact

A third-party or operator-chosen host receives live Claude, Codex, and Gemini credentials that can be reused outside those services. Install itself only unpacks local tool archives.

Mechanism

readCodexAuth, readGeminiAuth, and readClaudeOAuthToken load existing session material. detectProvidersFromEnv stores the raw values as oauthToken. On socket connect, updateDaemonState JSON-serializes detectedProviders to the configured server.

AI rationale

The daemon copies existing Claude keychain, Codex auth.json, and Gemini oauth files into provider state and sends that state to api.ozaiya.com or any host set in OZAIYA_SERVER_URL. That is credential forwarding to an operator-configured endpoint outside the credential's own service, activated by an explicit daemon command rather than an install hook.

Evidence

dist/api-CtgNkRPZ.cjsdist/index-8lHUhZM0.cjspackage.json~/.codex/auth.json~/.gemini/oauth_creds.json~/.claude.json

Network endpoints1

Source & flagged code

28 flagged

package.jsonView file

Lines 81-121json

81 "scripts/env-wrapper.cjs",

82 "scripts/claude_local_launcher.cjs",

83 "scripts/claude_remote_launcher.cjs",

84 "scripts/ripgrep_launcher.cjs",

85 "scripts/claude_version_utils.cjs",

86 "scripts/session_hook_forwarder.cjs",

87 "tools/archives",

88 "package.json"

89 ],

90 "scripts": {

91 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started ozaiya",

92 "typecheck": "tsc --noEmit",

93 "build": "shx rm -rf dist && npx tsc --noEmit && pkgroll",

94 "test": "$npm_execpath run build && vitest run",

95 "start": "$npm_execpath run build && node ./bin/ozaiya.mjs",

96 "dev": "tsx src/index.ts",

97 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

98 "dev:integration-test-env": "$npm_execpath run build && tsx --env-file .env.integration-test src/index.ts",

99 "prepublishOnly": "$npm_execpath run build && $npm_execpath test",

100 "release": "$npm_execpath install && release-it",

101 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

102 "// ==== Dev/Stable Variant Management ====": "",

103 "stable": "node scripts/env-wrapper.cjs stable",

104 "dev:variant": "node scripts/env-wrapper.cjs dev",

105 "// ==== Stable Version Quick Commands ====": "",

106 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

107 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

108 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

109 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

110 "// ==== Development Version Quick Commands ====": "",

111 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

112 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

113 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

114 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

115 "// ==== Setup ====": "",

116 "setup:dev": "node scripts/setup-dev.cjs",

117 "doctor": "node scripts/env-wrapper.cjs stable doctor",

118 "// ==== Development Linking ====": "",

119 "link:dev": "node scripts/link-dev.cjs",

120 "unlink:dev": "node scripts/link-dev.cjs unlink"

121 },

bin/ozaiya.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

5import { join, dirname } from 'path'

dist/index-8lHUhZM0.cjsView file

Lines 5264-5304javascript

5264 SHELL: shell

5265 };

5266 if (cwd) {

5267 env.HOME = cwd;

5268 }

5269 const username = process.env.USER

dist/setupOfflineReconnection-CsNUDUk9.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./api-CtgNkRPZ.cjs');

4var require$$1 = require('node:crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/setupOfflineReconnection-CsNUDUk9.cjsView on unpkg · L2

dist/api-CtgNkRPZ.cjsView file

•context = {\n await updateSettings((settings) => ({\n ...settings,\n machineId: void 0\n }));\n}\nasync function readDaemonState() {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) {\n return null;\n }\n const content = await promises.readFile(configuration.daemonStateFile, "utf-8");\n return JSON.parse(content);\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return null;\n }\n}\nfunction writeDaemonState(state) {\n fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), "utf-8");\n}\nfunction markDaemonOffline(stateReason) {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) return;\n const existing = JSON.parse(fs.readFileS

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-CtgNkRPZ.cjsView on unpkg

2Trigger-reachable chain: manifest.main -> dist/index.cjs -> dist/api-CtgNkRPZ.cjs L2: L3: var axios = require('axios'); L4: var http = require('node:http'); ... L15: var tweetnacl = require('tweetnacl'); L16: var require$$0$1 = require('child_process'); L17: var util = require('util'); ... L93: L94: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L95: const httpClient = proxyConfigured ? axios.create() : axios.create({ ... L185: "tools/archives", L186: "package.json" L187: ];

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-CtgNkRPZ.cjsView on unpkg · L2

bin/ozaiya-local.shView file

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/api-DRfiB6ad.mjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/api-DAWnl5V4.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api-DRfiB6ad.mjsView on unpkg

dist/index-Cpsmzffp.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-DmssgJkd.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-Cpsmzffp.cjsView on unpkg

dist/index-yrkI9YJA.mjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-CeHvGJ69.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-yrkI9YJA.mjsView on unpkg

dist/runGemini-isqO86cA.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/runGemini-CFyHQCx9.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-isqO86cA.cjsView on unpkg

scripts/claude_version_utils.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_version_utils.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-DU4G79VF.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-35_Gqsgl.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DU4G79VF.cjsView on unpkg

dist/runCodex-Btx_QtPi.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/runCodex-fUIdtuxT.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runCodex-Btx_QtPi.cjsView on unpkg

scripts/env-wrapper.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/env-wrapper.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-B9S56sRQ.mjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/runGemini-BdjkIt9P.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-B9S56sRQ.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/ripgrep_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-DpZga4DZ.mjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-CG2PEE_k.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DpZga4DZ.mjsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ozaiya.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

dist/index-8lHUhZM0.cjsView file

5284if (!shell) { L5285: const psPath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"; L5286: shell = fs$2.existsSync(psPath) ? "powershell.exe" : "cmd.exe";

High

Shell

Package source references shell execution.

dist/index-8lHUhZM0.cjsView on unpkg · L5284

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-8lHUhZM0.cjs: var node_readline = require('node:readline'); this.claudeEnvVars = opts.claudeEnvVars; this.claudeArgs = opts.claudeArgs; if (!this.claudeArgs) return; for (let i = 0; i < this.claudeArgs.length; i++) { const arg = this.claudeArgs[i]; if (i + 1 < this.claudeArgs.length) { const nextArg = this.claudeArgs[i + 1];

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-8lHUhZM0.cjsView on unpkg

dist/setupOfflineReconnection-CsNUDUk9.cjsView file

2L3: var persistence = require('./api-CtgNkRPZ.cjs'); L4: var require$$1 = require('node:crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/setupOfflineReconnection-CsNUDUk9.cjsView on unpkg · L2

dist/api-CtgNkRPZ.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-CtgNkRPZ.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-CtgNkRPZ.cjsView on unpkg · L2

bin/ozaiya-local.shView file

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/api-DRfiB6ad.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api-DRfiB6ad.mjsView on unpkg

dist/index-Cpsmzffp.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-Cpsmzffp.cjsView on unpkg

dist/index-yrkI9YJA.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-yrkI9YJA.mjsView on unpkg

dist/runGemini-isqO86cA.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-isqO86cA.cjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-DU4G79VF.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DU4G79VF.cjsView on unpkg

dist/runCodex-Btx_QtPi.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runCodex-Btx_QtPi.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-B9S56sRQ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-B9S56sRQ.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-DpZga4DZ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DpZga4DZ.mjsView on unpkg

Source & flagged code

28 flagged

package.jsonView file

Lines 81-121json

81 "scripts/env-wrapper.cjs",

82 "scripts/claude_local_launcher.cjs",

83 "scripts/claude_remote_launcher.cjs",

84 "scripts/ripgrep_launcher.cjs",

85 "scripts/claude_version_utils.cjs",

86 "scripts/session_hook_forwarder.cjs",

87 "tools/archives",

88 "package.json"

89 ],

90 "scripts": {

92 "typecheck": "tsc --noEmit",

93 "build": "shx rm -rf dist && npx tsc --noEmit && pkgroll",

94 "test": "$npm_execpath run build && vitest run",

95 "start": "$npm_execpath run build && node ./bin/ozaiya.mjs",

96 "dev": "tsx src/index.ts",

97 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

98 "dev:integration-test-env": "$npm_execpath run build && tsx --env-file .env.integration-test src/index.ts",

99 "prepublishOnly": "$npm_execpath run build && $npm_execpath test",

100 "release": "$npm_execpath install && release-it",

101 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

102 "// ==== Dev/Stable Variant Management ====": "",

103 "stable": "node scripts/env-wrapper.cjs stable",

104 "dev:variant": "node scripts/env-wrapper.cjs dev",

105 "// ==== Stable Version Quick Commands ====": "",

106 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

107 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

108 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

109 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

110 "// ==== Development Version Quick Commands ====": "",

111 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

112 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

113 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

114 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

115 "// ==== Setup ====": "",

116 "setup:dev": "node scripts/setup-dev.cjs",

117 "doctor": "node scripts/env-wrapper.cjs stable doctor",

118 "// ==== Development Linking ====": "",

119 "link:dev": "node scripts/link-dev.cjs",

120 "unlink:dev": "node scripts/link-dev.cjs unlink"

121 },

bin/ozaiya.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

5import { join, dirname } from 'path'

dist/index-8lHUhZM0.cjsView file

Lines 5264-5304javascript

5264 SHELL: shell

5265 };

5266 if (cwd) {

5267 env.HOME = cwd;

5268 }

5269 const username = process.env.USER

dist/setupOfflineReconnection-CsNUDUk9.cjsView file

Lines 1-22javascript

1'use strict';

3var persistence = require('./api-CtgNkRPZ.cjs');

4var require$$1 = require('node:crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/setupOfflineReconnection-CsNUDUk9.cjsView on unpkg · L2

dist/api-CtgNkRPZ.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-CtgNkRPZ.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-CtgNkRPZ.cjsView on unpkg · L2

bin/ozaiya-local.shView file

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/api-DRfiB6ad.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/api-DRfiB6ad.mjsView on unpkg

dist/index-Cpsmzffp.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-Cpsmzffp.cjsView on unpkg

dist/index-yrkI9YJA.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-yrkI9YJA.mjsView on unpkg

dist/runGemini-isqO86cA.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-isqO86cA.cjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-DU4G79VF.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DU4G79VF.cjsView on unpkg

dist/runCodex-Btx_QtPi.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runCodex-Btx_QtPi.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-B9S56sRQ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-B9S56sRQ.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-DpZga4DZ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-DpZga4DZ.mjsView on unpkg

ozaiya-cli@0.11.25

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code