xpxpmd@1.0.8: Suspicious npm security report (Warn)

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

MinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 10 file(s), 273 KB of source, external domains: commandcode.ai, github.com, staging.commandcode.ai

Oversized source lightweight scan

dist/cli.mjs2.17 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsObfuscatedMinifiedUrlStringscommandcode.aigithub.comstaging.commandcode.ai

Source & flagged code

9 flagged

dist/index.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// ── xpxpmd auto-update (injected at release; NOT in source) ──

3try {

4 const updateEnv = process.env;

5 if (updateEnv['XPXPMD_NO_UPDATE'] !== '1' && updateEnv['XPXPMD_SELFUPDATE_DONE'] !== '1') {

6 const {execSync, spawnSync} = await import('node:child_process');

7 const {fileURLToPath} = await import('node:url');

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L5

8 let updated = false;

9 try {

10 process.stderr.write('Updating xpxpmd…\n');

11 execSync('npm install -g xpxpmd@latest', {stdio: 'ignore'});

12 updated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L10

13 } catch {}

14 if (updated) {

15 const child = spawnSync(process.execPath, [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {

16 stdio: 'inherit',

17 env: {...updateEnv, XPXPMD_SELFUPDATE_DONE: '1'},

18 });

19 if (!child.error) process.exit(child.status == null ? 0 : child.status);

20 }

21 }

22} catch {}

23var r=process.env;r.NODE_ENV||(r.NODE_ENV="production"),await import(new URL("./cli.mjs",import.meta.url).href);

dist/cli.mjsView file

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,relative as s,resolve as a,isAbsolute as i,sep as l,basename as c,extname as d,win32 as u}from"path";import{fileU... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,relative as s,resolve as a,isAbsolute as i,sep as l,basename as c,extname as d,win32 as u}from"path";import{fileU... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import*as e from"path";import t,{join as n,dirname as r,parse as o,relative as s,resolve as a,isAbsolute as i,sep as l,basename as c,extname as d,win32 as u}from"path";import{fileU... L3: ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L1

vsix/commandcode-vscode.vsixView file

•path = vsix/commandcode-vscode.vsix kind = high_entropy_blob sizeBytes = 47491 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = compressed_blob sizeBytes = 47491 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

vsix/commandcode-vscode.vsixView on unpkg

•path = vsix/commandcode-vscode.vsix kind = nested_archive_needs_inspection sizeBytes = 47491 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

vsix/commandcode-vscode.vsixView on unpkg

Source & flagged code

9 flagged · loading source

dist/index.mjsView file

5if (updateEnv['XPXPMD_NO_UPDATE'] !== '1' && updateEnv['XPXPMD_SELFUPDATE_DONE'] !== '1') { L6: const {execSync, spawnSync} = await import('node:child_process'); L7: const {fileURLToPath} = await import('node:url');

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L5

10process.stderr.write('Updating xpxpmd…\n'); L11: execSync('npm install -g xpxpmd@latest', {stdio: 'ignore'}); L12: updated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L10

5if (updateEnv['XPXPMD_NO_UPDATE'] !== '1' && updateEnv['XPXPMD_SELFUPDATE_DONE'] !== '1') { L6: const {execSync, spawnSync} = await import('node:child_process'); L7: const {fileURLToPath} = await import('node:url');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L5

dist/cli.mjs

Findings

6 High4 Medium6 Low

HighChild Processdist/index.mjs

HighShell

HighSame File Env Network Executiondist/cli.mjs

HighCommand Output Exfiltrationdist/cli.mjs

HighRuntime Package Installdist/index.mjs

HighShips High Entropy Blobvsix/commandcode-vscode.vsix

MediumDynamic Requiredist/index.mjs

MediumEnvironment Vars

MediumShips Compressed Blobvsix/commandcode-vscode.vsix

MediumStructural Risk Force Deep Review

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowObfuscated

LowUrl Strings

Low