shadow-claw: Manual Review npm security report (Allow)

Loading npm security reports…

shadow-claw: Manual Review npm security report (Allow) | LPM Firewall

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 1,943 file(s), 44.7 MB of source, external domains: 10.0.0.1, 10.0.0.2, 10.0.0.5, 10.9.8.226, 127.0.0.1, 169.254.169.254, 169.254.170.2, 172.16.0.5, 172.20.0.1, 172.20.0.5, 192.168.1.1, 192.168.1.10, 192.168.1.100, 192.168.1.5, 192.168.1.50, a2ui.org, accounts.google.com, actions.google.com, ae.api.openai.com, agent-card.github.io, agent.example.com, ai.google.dev, aiplatform.googleapis.com, allowed.example.com, another.com, any.example.com, api.anthropic.com, api.example.com, api.external.com, api.figma.com, api.github.com, api.hf.co, api.linear.app, api.login.yahoo.com, api.myservice.com, api.nodemailer.com, api.notion.com, api.openai.com, api.telegram.org, api.test, api.test.example, api.weather.com, app.internal, app.vssps.visualstudio.com, attacker.com, attacker.github.io, auth.atlassian.com, auth.example.com, auth.openai.com, bad.example.com

Oversized source lightweight scan

dist/cli/chunk-BM8q9kx8.js5.74 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/cli/chunk-m59jzvxR.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/headless-agent.js7.24 MB file, sampled 256 KB

FilesystemNetworkWebSocketDynamicRequireHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapp.vssps.visualstudio.comauth.atlassian.comdeepwiki.comexample.comgithub.comgitlab.comhuggingface.colinear.applogin.microsoftonline.comoauth2.googleapis.comopenrouter.airouter.huggingface.coslack.comwww.figma.comwww.w3.orgxt-ml.github.io

dist/lib/webllm-B1HzRy_S.js6.16 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/webllm-BHNjOhwY.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/public/webllm-DmZ8TVhC.js5.75 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringshuggingface.coraw.githubusercontent.comwebgpureport.org

dist/server.js11.8 MB file, sampled 256 KB

FilesystemNetworkDynamicRequireHighEntropyStringsMinifiedUrlStringsaccounts.google.comapi.figma.comapi.linear.appapi.login.yahoo.comapi.notion.comapi.telegram.orgapp.vssps.visualstudio.comauth.atlassian.comcdn.jsdelivr.netcdnjs.cloudflare.comexample.comfonts.googleapis.comfonts.gstatic.comgithub.comgitlab.comhuggingface.cojson-schema.orglinear.applogin.microsoftonline.comoauth2.googleapis.comopenrouter.airouter.huggingface.coslack.comwww.figma.com

Source & flagged code

18 flagged

bin/version.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * @fileoverview CLI runner for version command, delegating to src/cli/tools/version.js.

5 */

7import { execFileSync } from "node:child_process";

8import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L6

9import { dirname, join } from "node:path";

10import process from "node:process";

11import { fileURLToPath } from "node:url";

13const __dirname = dirname(fileURLToPath(import.meta.url));

14const distTarget = join(__dirname, "../dist/cli/tools/version.js");

16if (!existsSync(distTarget)) {

17 const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";

18 execFileSync(npmCmd, ["run", "-s", "build:cli"], {

19 cwd: join(__dirname, ".."),

20 stdio: "inherit",

21 });

22}

24const { runVersion } = await import("../dist/cli/tools/version.js");

26runVersion().catch((err) => {

dist/cli/chunk-C497uyLU.jsView file

Lines 1-40javascript

1import{t as e}from"./chunk-BChOKoxf.js";import{t}from"./chunk-gAdqVxWq.js";import{a as n,i as r,n as i,r as a,t as o}from"./chunk-Cpdoq2Nw.js";import

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View file

1import{t as e}from"./chunk-mjuZTMQB.js";import t from"process";function n(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),a.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View on unpkg · L1

dist/cli/chunk-DKmoa1-u.jsView file

Lines 1-1javascript

1import{t as e}from"./chunk-uAI_Zi6n.js";import{existsSync as t}from"node:fs";import n from"node:path";import{pathToFileURL as r}from"node:url";import i

dist/electron/main.cjsView file

99${t} L100: ${i(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L101: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=/* @__PURE__ */ new Date,signingRegion:n,s... L102: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L113: `)?{tag:t,value:``}:{tag:t,value:e}}let c={};for(let e of i)e.trim()===``&&e.includes(` L114: `)||(c[`#text`]=`#text`in c?c[`#text`]+e:e);for(let e of a)e.tag===`__proto__`&&l(c),e.tag in c?Array.isArray(c[e.tag])?c[e.tag].push(e.value):c[e.tag]=[c[e.tag],e.value]:c[e.tag]=... L115: Multipl

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/electron/main.cjsView on unpkg · L99

99Trigger-reachable chain: manifest.main -> dist/electron/main.cjs L99: ${t} L100: ${i(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let n of e.split(`/`))n?.length!==0&&n!==`.`&&(n===`..`?t.pop():t.push(n));let n=`${e?.startsWith(`/`)?`/`:`... L101: `);return this.signString(h,{signingDate:n,signingRegion:c,signingService:o,eventStreamCredentials:s})}async signMessage(e,{signingDate:t=/* @__PURE__ */ new Date,signingRegion:n,s... L102: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L113: `)?{tag:t,value:``}:{tag:t,value:e}}let c={};for(let e of i)e.trim()===``&&e.includes(` L114: `)||(c[`#text`]=`#text`in c?c[`#text`]+e:e);for(let e of a)e.tag===`__proto__`&&l(c),e.tag in c?Array.isArray(c[e.tag])?c[e.tag].pus

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/electron/main.cjsView on unpkg · L99

dist/cli/chunk-C2wXTI2R.jsView file

Lines 1-19javascript

1import{i as e,n as t,t as n}from"./chunk-CwYF3Rm8.js";import{n as r,t as i}from"./chunk-DpWnkQpI.js";function a(e,t,n

src/cli/commands/agent.tsView file

98!process.stdin.isTTY && L99: Boolean(process.stderr.isTTY || process.stdout.isTTY); L100: const isTTY = ... L109: : Boolean( L110: process.env.CI && L111: !["0", "false"].includes(process.env.CI.toLowerCase()), ... L119: workspaceDir: workspace, L120: contentRoot: process.cwd(), L121: cacheDir: options.cacheDir, ... L143: const defaultConfig = { L144: $schema: "https://json-schema.org/draft/2020-12/schema", L145: site: {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/cli/commands/agent.tsView on unpkg · L98

dist/cli/chunk-DxC9rzb2.jsView file

1import{i as e,o as t,t as n}from"./chunk-B--rR4-3.js";import{n as r,t as i}from"./chunk-DpWnkQpI.js";import a from"process";import{Buffer as o}from"buffer";import{createWriteStream... L2: `)||n,code:r,status:t},e.data.error)}return Object.assign({message:n,code:r,status:t},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};function i(e,t){switch(e)... ... L9: `+f+`}`:`{`+p.join(`,`)+`}`,t=f,u}}typeof r.stringify!=`function`&&(r.stringify=function(e,n,r){var a;if(t=``,i=``,typeof r==`number`)for(a=0;a<r;a+=1)i+=` `;else typeof r==`string... L10: `,r:`\r`,t:` `},c,l=function(e){throw{name:`SyntaxError`,message:e,at:a,text:c}},u=function(e){return e&&e!==o&&l(`Expected '`+e+`' instead of '`+o+`'`),o=c.charAt(a),a+=1,o},d=fun... L11: /*! safe-buffer. MIT License. Feross A

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli/chunk-DxC9rzb2.jsView on unpkg · L1

dist/public/agent.worker.jsView file

1import{i as e,n as t,r as n,t as r}from"./rolldown-runtime-DBVvNlSN.js";import{i,n as a,r as o,t as s}from"./txPromise-DlzJBj9N.js";import{t as c}from"./getConfig-DSieAlsi.js";cons... L2: /*! @license DOMPurify 3.4.16 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.16/L... ... L238: L239: `.substring(0,i)+r}function Jd(e){return e!=null&&(typeof e==`string`||e.nodeType&&(e.nodeType===1||e.nodeType===9||e.nodeType===11))}var Yd=Ya(),Xd=Object.create,Zd=Object.defineP... L240: ... L1032: `,0;let a=Math.max(...n.map(([e])=>typeof e==`number`?e:0))+1+r;if(a<0)return e.state.expansionStderr=(e.state.expansionStderr||``)+`bash: line ${i}: ${t.array}: bad array subscrip... L1033: `,0;r=a}let i=

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/public/agent.worker.jsView on unpkg · L1

dist/cli/chunk-BmlqXKZq.jsView file

28Cross-file remote execution chain: dist/cli/chunk-BmlqXKZq.js spawns dist/cli/chunk-BU-vs0np.js; helper contains network access plus dynamic code execution. L28: Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream, ... L43: child_process: L44: execSync(cmd) throws on non-zero exit, returns stdout L45: spawnSync(cmd, args) returns { stdout, stderr, status } ... L49: L50: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L51: EOL, cpus(), endianness() L52: L53: url: URL, URLSearchParams, parse(), format() L54:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/chunk-BmlqXKZq.jsView on unpkg · L28

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 12409305 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/server.jsView on unpkg

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View on unpkg

dist/cli/chunk-48riq6i6.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = shadow-claw@1.42.3 matchedIdentity = npm:c2hhZG93LWNsYXc:1.42.3 similarity = 0.392 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/chunk-48riq6i6.jsView on unpkg

Source & flagged code

18 flagged · loading source

bin/version.mjsView file

6L7: import { execFileSync } from "node:child_process"; L8: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L6

dist/cli/chunk-C497uyLU.jsView file

20`).trim(),n=``,r=t.length===0,i=!1,a=e=>{if(i||!e)return e;let t=e.replace(/^\s*ASSISTANT:\s*/i,``);return t!==e&&(i=!0),t};return{push(e){let i=String(e||``).replace(/\r\n/g,` L21: `);if(r)return a(i);n+=i;let o=n.trimStart();if(t.startsWith(o)&&o.length<t.length)return``;r=!0;let s=n,c=n.trimStart();return c.startsWith(t)&&(s=c.slice(t.length)),n=``,a(s)},fl... L22:

High

Shell

Package source references shell execution.

dist/cli/chunk-C497uyLU.jsView on unpkg · L20

1import{t as e}from"./chunk-BChOKoxf.js";import{t}from"./chunk-gAdqVxWq.js";import{a as n,i as r,n as i,r as a,t as o}from"./chunk-Cpdoq2Nw.js";import{c as s,o as c,u as l}from"./ch... L2: `:``)+n),e&&!i&&(i=e.message),r(i)});t&&a.stdin&&(a.stdin.write(t),a.stdin.end())});j(ct),globalThis.__headlessBashExecutor=ct;function lt(e,t,n){let r=t.input_tokens||0,i=t.output... L3: L4: `);i=a.pop()||``;for(let e of a){let t=e.split(` L5: `);for(let e of t)if(e&&!e.startsWith(`:`)&&e.startsWith(`data: `)){let t=e.slice(6).trim();if(t===`[DONE]`)continue;try{yield JSON.parse(t)}catch{}}}}}finally{n.releaseLock()}}con... L6: `)].join(` ... L13: L14: `).slice(0,1e4)}function Kt(e){let t=e.trim();return t?`Tool result:\n${t}`:``}let qt=null;function Jt(e){qt=e}let Yt=null;function Xt(e){Yt=e}async

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/chunk-C497uyLU.jsView on unpkg · L1

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View file

High

Eval

Package source references dynamic code evaluation.

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View on unpkg · L1

dist/cli/chunk-DKmoa1-u.jsView file

1import{t as e}from"./chunk-uAI_Zi6n.js";import{existsSync as t}from"node:fs";import n from"node:path";import{pathToFileURL as r}from"node:url";import i from"node:process";const a=e...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/chunk-DKmoa1-u.jsView on unpkg · L1

dist/electron/main.cjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/electron/main.cjsView on unpkg · L99

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/electron/main.cjsView on unpkg · L99

dist/cli/chunk-C2wXTI2R.jsView file

2`)}};D=/* @__PURE__ */ new WeakMap,O=/* @__PURE__ */ new WeakMap,k=/* @__PURE__ */ new WeakMap,Ae=/* @__PURE__ */ new WeakMap,je=/* @__PURE__ */ new WeakMap,ke=/* @__PURE__ */ new ... L3: `,`\r`]),Pe.NEWLINE_REGEXP=/\r\n|[\n\r]/g;function Fe(e,t,n){for(let r=t;r<n;r++){if(e[r]===10)return{preceding:r,index:r+1,carriage:!1};if(e[r]===13)return{preceding:r,index:r+1,c... L4: `);e.enqueue(i)}catch(t){e.error(t),r().catch(()=>void 0)}},cancel:r})}};$e=async function(e,t){let n=e.return;n&&(o(this,Qe,`f`)||t.abort(),await Reflect.apply(n,e,[]))};function ... ... L8: \r `.includes(e[r]);)r++};return o()},Lo=e=>Fo(e,V.ALL^V.NUM);var H,U,Ro,zo,Bo,W,Vo,Ho,Uo,Wo,Go,Ko,qo,Jo,Yo,Xo;function Zo(e){try{return Lo(e)}catch(t){if(t instanceof Po||t instan... L9: `&&f!==`\r`&&f!==` `&&(s=!0),c)o?o=!1:f=

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/chunk-C2wXTI2R.jsView on unpkg · L2

src/cli/commands/agent.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/cli/commands/agent.tsView on unpkg · L98

dist/cli/chunk-DxC9rzb2.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli/chunk-DxC9rzb2.jsView on unpkg · L1

dist/public/agent.worker.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/public/agent.worker.jsView on unpkg · L1

dist/cli/chunk-BmlqXKZq.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/chunk-BmlqXKZq.jsView on unpkg · L28

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 12409305 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/server.jsView on unpkg

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View on unpkg

dist/cli/chunk-48riq6i6.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/chunk-48riq6i6.jsView on unpkg

Source & flagged code

18 flagged

bin/version.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * @fileoverview CLI runner for version command, delegating to src/cli/tools/version.js.

5 */

7import { execFileSync } from "node:child_process";

8import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/version.mjsView on unpkg · L6

9import { dirname, join } from "node:path";

10import process from "node:process";

11import { fileURLToPath } from "node:url";

13const __dirname = dirname(fileURLToPath(import.meta.url));

14const distTarget = join(__dirname, "../dist/cli/tools/version.js");

16if (!existsSync(distTarget)) {

17 const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";

18 execFileSync(npmCmd, ["run", "-s", "build:cli"], {

19 cwd: join(__dirname, ".."),

20 stdio: "inherit",

21 });

22}

24const { runVersion } = await import("../dist/cli/tools/version.js");

26runVersion().catch((err) => {

dist/cli/chunk-C497uyLU.jsView file

Lines 1-40javascript

1import{t as e}from"./chunk-BChOKoxf.js";import{t}from"./chunk-gAdqVxWq.js";import{a as n,i as r,n as i,r as a,t as o}from"./chunk-Cpdoq2Nw.js";import

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View file

High

Eval

Package source references dynamic code evaluation.

dist/cli/chunk-BU-vs0np.js#virtual:string-array:round1View on unpkg · L1

dist/cli/chunk-DKmoa1-u.jsView file

Lines 1-1javascript

1import{t as e}from"./chunk-uAI_Zi6n.js";import{existsSync as t}from"node:fs";import n from"node:path";import{pathToFileURL as r}from"node:url";import i

dist/electron/main.cjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/electron/main.cjsView on unpkg · L99

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/electron/main.cjsView on unpkg · L99

dist/cli/chunk-C2wXTI2R.jsView file

Lines 1-19javascript

1import{i as e,n as t,t as n}from"./chunk-CwYF3Rm8.js";import{n as r,t as i}from"./chunk-DpWnkQpI.js";function a(e,t,n

src/cli/commands/agent.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/cli/commands/agent.tsView on unpkg · L98

dist/cli/chunk-DxC9rzb2.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli/chunk-DxC9rzb2.jsView on unpkg · L1

dist/public/agent.worker.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/public/agent.worker.jsView on unpkg · L1

dist/cli/chunk-BmlqXKZq.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/chunk-BmlqXKZq.jsView on unpkg · L28

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 12409305 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/server.jsView on unpkg

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/chunk-B9hwXAdM.js#virtual:string-array:round1View on unpkg

dist/cli/chunk-48riq6i6.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/chunk-48riq6i6.jsView on unpkg

shadow-claw@1.49.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code