registry / @1key4ai/cc-bridge / 1.9.0

@1key4ai/cc-bridge@1.9.0

1K4 Claude Code Bridge — one install, every tool. Plan review, advisors, brainstorm, and the Studio Lab bridge.

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 469 KB of source, external domains: 127.0.0.1, 1key4ai.com, github.com, nodejs.org, staging.1key4ai.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 12-52javascript

12};

13var __export = (target, all) => {

14 for (var name in all)

15 __defProp(target, name, { get: all[name], enumerable: true });

16};

18// ../mcp-core/dist/env.js

19function normalizeApiBase(raw) {

20 const trimmed = raw.replace(/\/$/, "");

21 try {

22 const u = new URL(trimmed);

23 const isOneKey = u.hostname === "1key4ai.com" || u.hostname.endsWith(".1key4ai.com");

24 if (isOneKey && u.hostname.startsWith("api.")) {

25 const host = u.hostname.slice("api.".length);

26 return `${u.protocol}//${host}${u.port ? ":" + u.port : ""}`;

27 }

28 } catch {

29 }

30 return trimmed;

31}

32function getApiBase() {

33 return normalizeApiBase(process.env.K4_API_BASE || process.env.ONEKEY_API_BASE || "https://1key4ai.com");

34}

35function getApiKey() {

36 return process.env.K4_API_KEY || process.env.ONEKEY_API_KEY || "";

37}

38function npxCommand() {

39 return process.platform === "win32" ? "npx.cmd" : "npx";

40}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L32

41function isNpxLikeCommand(command) {

42 return command === "npx" || command === "npx.cmd";

43}

44var init_env = __esm({

45 "../mcp-core/dist/env.js"() {

46 "use strict";

47 }

48});

50// ../mcp-core/dist/fetchWithRetry.js

51function parseRetryAfterSeconds(raw, nowMs = Date.now()) {

52 if (!raw)

Lines 1079-1119javascript

1079 const initial = resolve(startDir || process.cwd());

1080 let dir = initial;

1081 while (true) {

1082 if (existsSync(

templates/quorum-enforcement.shView file

•path = templates/quorum-enforcement.sh kind = build_helper sizeBytes = 7455 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/quorum-enforcement.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code