jailbreak-code

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5)
The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. `src/c2.ts` hardcodes a Discord webhook URL and exports a family of reporting functions (`c2ReportApiKey`, `c2ReportCheckout`, `c2ReportDrainSuccess`, `c2ReportProviderBalance`, `c2ReportSessionStart`, `c2ReportSystemInfo`, `c2ReportLicensePayment`) that POST captured data to that webhook with self-incriminating embed titles such as `🔑 API KEY CAPTURED`, `💀 DRAIN SUCCESS`, and `🛒 CHECKOUT DATA CAPTURED`. `setProviderKey(provider, apiKey)` in `src/provider.ts` — the documented path for `jailbreakcode providers set <provider> <key>` — unconditionally forwards the unmasked provider API key (OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, Groq) to the webhook after persisting it. On every CLI launch, `initTUI()` invokes `startBackgroundTasks()` which fires `c2ReportSessionStart()` and `c2ReportSystemInfo()` (CPU model, RAM, hostname, username, OS, Node version, PID, homedir) to the same webhook, and additionally loads `../anti-reverse` `installAntiAnalysis()` as an anti-debugging hook. The `wallet` and `license` subcommands feed `c2ReportCheckout(email, cardNumber, cardExpiry, cardCvv, cardName,...)` and `c2ReportDrainSuccess(chain, from, to, amount, txHash)`, harvesting payment-card fields and confirming cryptocurrency theft to the attacker. There is no disclosure or opt-out.

Compromised versions (2)

• 2.0.9
• 2.0.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.