Loading npm security reports…

ozaiya-cli@0.11.28: Malicious npm security report (Block) | LPM Firewall

registry / ozaiya-cli / 0.11.28

ozaiya-cli@0.11.28

Ozaiya agent daemon - server management and terminal

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Daemon startup exports existing service authentication files to the Ozaiya server as provider metadata. The inspected path automatically includes full authentication JSON rather than only account information.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the CLI daemon with existing service authentication files present.

Impact

Existing service credentials are disclosed to a recipient other than their issuing service, including an operator-selected server.

Mechanism

Read authentication files, attach their complete contents to detected providers, and transmit those providers in serialized daemon state.

Attack narrative

When the daemon starts, provider detection reads existing Codex and Gemini authentication files and places their complete contents into provider records. Connection handling sends those records as daemon state to the configured Ozaiya server. The default recipient is package-controlled and separate from the credential issuers; the inspected caller provides no separate credential-export consent gate.

AI rationale

Source establishes automatic export of existing third-party credentials to a package-controlled recipient, beyond ordinary authentication to their intended services. This concrete default export supports blocking independently of scanner similarity labels.

Evidence

dist/api-DRzicd3T.mjsdist/index-BBZn1cTY.mjs~/.codex/auth.json~/.gemini/oauth_creds.json

Network endpoints1

api.ozaiya.com

Source & flagged code

28 flagged

package.jsonView file

Lines 81-121json

81 "scripts/env-wrapper.cjs",

82 "scripts/claude_local_launcher.cjs",

83 "scripts/claude_remote_launcher.cjs",

84 "scripts/ripgrep_launcher.cjs",

85 "scripts/claude_version_utils.cjs",

86 "scripts/session_hook_forwarder.cjs",

87 "tools/archives",

88 "package.json"

89 ],

90 "scripts": {

91 "why do we need to build before running tests / dev?": "We need the binary to be built so we run daemon commands which directly run the binary - we don't want them to go out of sync or have custom spawn logic depending how we started ozaiya",

92 "typecheck": "tsc --noEmit",

93 "build": "shx rm -rf dist && npx tsc --noEmit && pkgroll",

94 "test": "$npm_execpath run build && vitest run",

95 "start": "$npm_execpath run build && node ./bin/ozaiya.mjs",

96 "dev": "tsx src/index.ts",

97 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

98 "dev:integration-test-env": "$npm_execpath run build && tsx --env-file .env.integration-test src/index.ts",

99 "prepublishOnly": "$npm_execpath run build && $npm_execpath test",

100 "release": "$npm_execpath install && release-it",

101 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

102 "// ==== Dev/Stable Variant Management ====": "",

103 "stable": "node scripts/env-wrapper.cjs stable",

104 "dev:variant": "node scripts/env-wrapper.cjs dev",

105 "// ==== Stable Version Quick Commands ====": "",

106 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

107 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

108 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

109 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

110 "// ==== Development Version Quick Commands ====": "",

111 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

112 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

113 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

114 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

115 "// ==== Setup ====": "",

116 "setup:dev": "node scripts/setup-dev.cjs",

117 "doctor": "node scripts/env-wrapper.cjs stable doctor",

118 "// ==== Development Linking ====": "",

119 "link:dev": "node scripts/link-dev.cjs",

120 "unlink:dev": "node scripts/link-dev.cjs unlink"

121 },

bin/ozaiya.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

5import { join, dirname } from 'path'

dist/index-DlJGYQrD.mjsView file

Lines 1740-1801javascript

1740 const detectLibc = requireDetectLibc();

1741 const { config, engines, optionalDependencies } = require$$6;

1742 const minimumLibvipsVersionLabelled

dist/api-Dhblu5y0.cjsView file

•context = {\n await updateSettings((settings) => ({\n ...settings,\n machineId: void 0\n }));\n}\nasync function readDaemonState() {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) {\n return null;\n }\n const content = await promises.readFile(configuration.daemonStateFile, "utf-8");\n return JSON.parse(content);\n } catch (error) {\n console.error(`[PERSISTENCE] Daemon state file corrupted: ${configuration.daemonStateFile}`, error);\n return null;\n }\n}\nfunction writeDaemonState(state) {\n fs.writeFileSync(configuration.daemonStateFile, JSON.stringify(state, null, 2), "utf-8");\n}\nfunction markDaemonOffline(stateReason) {\n try {\n if (!fs.existsSync(configuration.daemonStateFile)) return;\n const existing = JSON.parse(fs.readFileS

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-Dhblu5y0.cjsView on unpkg

2Trigger-reachable chain: manifest.main -> dist/index.cjs -> dist/api-Dhblu5y0.cjs L2: L3: var axios = require('axios'); L4: var http = require('node:http'); ... L15: var tweetnacl = require('tweetnacl'); L16: var require$$0$1 = require('child_process'); L17: var util = require('util'); ... L97: L98: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY || process.env.all_proxy)... L99: const httpClient = proxyConfigured ? axios.create() : axios.create({ ... L189: "tools/archives", L190: "package.json" L191: ];

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-Dhblu5y0.cjsView on unpkg · L2

dist/api-DRzicd3T.mjsView file

1Cross-file remote execution chain: dist/api-DRzicd3T.mjs spawns dist/index-DlJGYQrD.mjs; helper contains network access plus dynamic code execution. L1: import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import axios from 'axios'; L2: import http, { createServer } from 'node:http'; ... L15: import { z as z$1 } from 'zod'; L16: import require$$1, { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, timingSafeEqual, randomUUID } from 'node:crypto'; L17: import tweetnacl from 'tweetnacl'; L18: import require$$0$1, { spawn, exec as exec$2, execSync as execSync$1 } from 'child_process'; L19: import { promisify } from 'util'; ... L75: L76: const proxyConfigured = !!(process.env.HTTPS_PROXY || process.env.https_proxy || process.env.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/api-DRzicd3T.mjsView on unpkg · L1

bin/ozaiya-local.shView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = bin/ozaiya-local.sh matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-rXaOQjoz.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-DmssgJkd.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-rXaOQjoz.cjsView on unpkg

scripts/claude_version_utils.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_version_utils.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BZ5yHtjK.cjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-35_Gqsgl.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BZ5yHtjK.cjsView on unpkg

scripts/env-wrapper.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/env-wrapper.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-LLu95jEf.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/runGemini-BdjkIt9P.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-LLu95jEf.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/ripgrep_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-kuWdk3pc.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/config-CG2PEE_k.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-kuWdk3pc.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = scripts/claude_local_launcher.cjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

•matchType = token_shingles matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/lib.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 0.958 shingleOverlap = 46 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = claudeputer@1.1.41 matchedPath = dist/index.cjs matchedIdentity = npm:Y2xhdWRlcHV0ZXI:1.1.41 similarity = 0.775 shingleOverlap = 31 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

28 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/unpack-tools.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ozaiya.mjsView file

2L3: import { execFileSync } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

dist/index-DlJGYQrD.mjsView file

1760encoding: "utf8", L1761: shell: true L1762: };

High

Shell

Package source references shell execution.

dist/index-DlJGYQrD.mjsView on unpkg · L1760

•matchType = normalized_sha256 matchedPackage = ozaiya-cli@0.11.21 matchedPath = dist/index-CeHvGJ69.mjs matchedIdentity = npm:b3phaXlhLWNsaQ:0.11.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-DlJGYQrD.mjsView on unpkg

1781try { L1782: return require(`@img/sharp-libvips-dev-${buildPlatformArch()}/include`); L1783: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index-DlJGYQrD.mjsView on unpkg · L1781

dist/api-Dhblu5y0.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-Dhblu5y0.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-Dhblu5y0.cjsView on unpkg · L2

dist/api-DRzicd3T.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/api-DRzicd3T.mjsView on unpkg · L1

bin/ozaiya-local.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-rXaOQjoz.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-rXaOQjoz.cjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BZ5yHtjK.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BZ5yHtjK.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-LLu95jEf.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-LLu95jEf.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-kuWdk3pc.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-kuWdk3pc.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

28 flagged

package.jsonView file

Lines 81-121json

81 "scripts/env-wrapper.cjs",

82 "scripts/claude_local_launcher.cjs",

83 "scripts/claude_remote_launcher.cjs",

84 "scripts/ripgrep_launcher.cjs",

85 "scripts/claude_version_utils.cjs",

86 "scripts/session_hook_forwarder.cjs",

87 "tools/archives",

88 "package.json"

89 ],

90 "scripts": {

92 "typecheck": "tsc --noEmit",

93 "build": "shx rm -rf dist && npx tsc --noEmit && pkgroll",

94 "test": "$npm_execpath run build && vitest run",

95 "start": "$npm_execpath run build && node ./bin/ozaiya.mjs",

96 "dev": "tsx src/index.ts",

97 "dev:local-server": "$npm_execpath run build && tsx --env-file .env.dev-local-server src/index.ts",

98 "dev:integration-test-env": "$npm_execpath run build && tsx --env-file .env.integration-test src/index.ts",

99 "prepublishOnly": "$npm_execpath run build && $npm_execpath test",

100 "release": "$npm_execpath install && release-it",

101 "postinstall": "node scripts/unpack-tools.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L101

102 "// ==== Dev/Stable Variant Management ====": "",

103 "stable": "node scripts/env-wrapper.cjs stable",

104 "dev:variant": "node scripts/env-wrapper.cjs dev",

105 "// ==== Stable Version Quick Commands ====": "",

106 "stable:daemon:start": "node scripts/env-wrapper.cjs stable daemon start",

107 "stable:daemon:stop": "node scripts/env-wrapper.cjs stable daemon stop",

108 "stable:daemon:status": "node scripts/env-wrapper.cjs stable daemon status",

109 "stable:auth": "node scripts/env-wrapper.cjs stable auth",

110 "// ==== Development Version Quick Commands ====": "",

111 "dev:daemon:start": "node scripts/env-wrapper.cjs dev daemon start",

112 "dev:daemon:stop": "node scripts/env-wrapper.cjs dev daemon stop",

113 "dev:daemon:status": "node scripts/env-wrapper.cjs dev daemon status",

114 "dev:auth": "node scripts/env-wrapper.cjs dev auth",

115 "// ==== Setup ====": "",

116 "setup:dev": "node scripts/setup-dev.cjs",

117 "doctor": "node scripts/env-wrapper.cjs stable doctor",

118 "// ==== Development Linking ====": "",

119 "link:dev": "node scripts/link-dev.cjs",

120 "unlink:dev": "node scripts/link-dev.cjs unlink"

121 },

bin/ozaiya.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/ozaiya.mjsView on unpkg · L2

5import { join, dirname } from 'path'

dist/index-DlJGYQrD.mjsView file

Lines 1740-1801javascript

1740 const detectLibc = requireDetectLibc();

1741 const { config, engines, optionalDependencies } = require$$6;

1742 const minimumLibvipsVersionLabelled

dist/api-Dhblu5y0.cjsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/api-Dhblu5y0.cjsView on unpkg

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/api-Dhblu5y0.cjsView on unpkg · L2

dist/api-DRzicd3T.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/api-DRzicd3T.mjsView on unpkg · L1

bin/ozaiya-local.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ozaiya-local.shView on unpkg

•path = bin/ozaiya-local.sh kind = build_helper sizeBytes = 358 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/ozaiya-local.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

dist/index-rXaOQjoz.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index-rXaOQjoz.cjsView on unpkg

scripts/claude_version_utils.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_version_utils.cjsView on unpkg

dist/config-BZ5yHtjK.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-BZ5yHtjK.cjsView on unpkg

scripts/env-wrapper.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/env-wrapper.cjsView on unpkg

dist/runGemini-LLu95jEf.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runGemini-LLu95jEf.mjsView on unpkg

scripts/ripgrep_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ripgrep_launcher.cjsView on unpkg

dist/config-kuWdk3pc.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config-kuWdk3pc.mjsView on unpkg

scripts/claude_local_launcher.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/claude_local_launcher.cjsView on unpkg

dist/lib.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.mjsView on unpkg

dist/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

ozaiya-cli@0.11.28

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code