ozaiya-cli@0.11.27: Suspicious npm security report (Warn)

Loading npm security reports…

ozaiya-cli@0.11.27: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

28 flagged

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ozaiya.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

dist/api-CZvufn1M.mjsView file

2265L2266: const execAsync = promisify(exec$2); L2267: function registerCommonHandlers(rpcHandlerManager, workingDirectory) {

High

Shell

Package source references shell execution.

dist/api-CZvufn1M.mjsView on unpkg · L2265

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L359: } L360: if (!existsSync(this.ozaiyaHomeDir)) { L361: mkdirSync(this.ozaiyaHomeDir, { recursive: true }); ... L6516: const candidates = [ L6517: resolve$1(projectPath(), "tools", "unpacked", "ozaiya-native-screen.node"), L6518: resolve$1(projectPath(), "..", "tools", "unpacked", "ozaiya-native-screen.node") ... L8316: screenW = $.NSScreen.mainScreen.frame.size.width; L8317: } catch(e) {} L8318: }

High

Suspicious Native Addon Load

Source dynamically best-effort loads a bundled native addon.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/api-CZvufn1M.mjsView on unpkg · L1

4273if (!isLaunchAgentInstalled()) return; L4274: const { execSync } = require("child_process"); L4275: const uid = process.getuid?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/api-CZvufn1M.mjsView on unpkg · L4273

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/api-CZvufn1M.mjsView on unpkg · L1

dist/api-BRaRJJ1V.cjsView file

•context = {\n await updateSettings((settings) => ({\n ...settings,\n machineId: void 0\n }));\n}\nasync function readDaemonState() {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) {\n return null;\n }\n const content = await promises.readFile(configuration.daemonStateFile, "utf-8");\n return JSON.parse(content);\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return null;\n }\n}\nfunction writeDaemonState(state) {\n fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), "utf-8");\n}\nfunction markDaemonOffline(stateReason) {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) return;\n const existing = JSON.parse(fs.readFileS

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-BRaRJJ1V.cjsView on unpkg

2Trigger-reachable chain: manifest.main -> dist/index.cjs -> dist/api-BRaRJJ1V.cjs L2: L3: var axios = require('axios'); L4: var http = require('node:http'); ... L15: var tweetnacl = require('tweetnacl'); L16: var require$$0$1 = require('child_process'); L17: var util = require('util'); ... L97: L98: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L99: const httpClient = proxyConfigured ? axios.create() : axios.create({ ... L189: "tools/archives", L190: "package.json" L191: ];

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-BRaRJJ1V.cjsView on unpkg · L2

bin/ozaiya-local.shView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = bin/ozaiya-local.sh matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-D3KRKPLu.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-DmssgJkd.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-D3KRKPLu.cjsView on unpkg

dist/index-uE0i3kzi.mjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-CeHvGJ69.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-uE0i3kzi.mjsView on unpkg

scripts/claude_version_utils.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_version_utils.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BHaZcpZm.cjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-35_Gqsgl.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BHaZcpZm.cjsView on unpkg

scripts/env-wrapper.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/env-wrapper.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-DFhbcQy_.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/runGemini-BdjkIt9P.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-DFhbcQy_.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/ripgrep_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-rY_BaDJQ.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-CG2PEE_k.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-rY_BaDJQ.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_local_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/lib.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 0.958 shingleOverlap = 46 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 0.775 shingleOverlap = 31 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ozaiya.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

dist/api-CZvufn1M.mjsView file

2265L2266: const execAsync = promisify(exec$2); L2267: function registerCommonHandlers(rpcHandlerManager, workingDirectory) {

High

Shell

Package source references shell execution.

dist/api-CZvufn1M.mjsView on unpkg · L2265

High

Suspicious Native Addon Load

Source dynamically best-effort loads a bundled native addon.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/api-CZvufn1M.mjsView on unpkg · L1

4273if (!isLaunchAgentInstalled()) return; L4274: const { execSync } = require("child_process"); L4275: const uid = process.getuid?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/api-CZvufn1M.mjsView on unpkg · L4273

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/api-CZvufn1M.mjsView on unpkg · L1

dist/api-BRaRJJ1V.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-BRaRJJ1V.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-BRaRJJ1V.cjsView on unpkg · L2

bin/ozaiya-local.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-D3KRKPLu.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-D3KRKPLu.cjsView on unpkg

dist/index-uE0i3kzi.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-uE0i3kzi.mjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BHaZcpZm.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BHaZcpZm.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-DFhbcQy_.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-DFhbcQy_.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-rY_BaDJQ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-rY_BaDJQ.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

28 flagged

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ozaiya.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

dist/api-CZvufn1M.mjsView file

2265L2266: const execAsync = promisify(exec$2); L2267: function registerCommonHandlers(rpcHandlerManager, workingDirectory) {

High

Shell

Package source references shell execution.

dist/api-CZvufn1M.mjsView on unpkg · L2265

High

Suspicious Native Addon Load

Source dynamically best-effort loads a bundled native addon.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/api-CZvufn1M.mjsView on unpkg · L1

4273if (!isLaunchAgentInstalled()) return; L4274: const { execSync } = require("child_process"); L4275: const uid = process.getuid?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/api-CZvufn1M.mjsView on unpkg · L4273

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/api-CZvufn1M.mjsView on unpkg · L1

1import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L77: const httpClient = proxyConfigured ? axios.create() :

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/api-CZvufn1M.mjsView on unpkg · L1

dist/api-BRaRJJ1V.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-BRaRJJ1V.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-BRaRJJ1V.cjsView on unpkg · L2

bin/ozaiya-local.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-D3KRKPLu.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-D3KRKPLu.cjsView on unpkg

dist/index-uE0i3kzi.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-uE0i3kzi.mjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BHaZcpZm.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BHaZcpZm.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-DFhbcQy_.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-DFhbcQy_.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-rY_BaDJQ.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-rY_BaDJQ.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

ozaiya-cli@0.11.27

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code