registry / @adityaaria/spark / 6.1.7

@adityaaria/spark@6.1.7

SPARK skills and runtime bootstrap for coding agents

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 9 file(s), 55.9 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-33json

2 "name": "@adityaaria/spark",

3 "version": "6.1.7",

4 "description": "SPARK skills and runtime bootstrap for coding agents",

5 "type": "module",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "spark": "bin/spark.js"

11 },

12 "scripts": {

13 "install": "bash bin/spark-install.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "uninstall": "bash bin/spark-uninstall.sh",

15 "update": "bash bin/spark-update.sh",

16 "test": "bash tests/native-installer/test-spark-install.sh && bash tests/native-installer/test-cli-wrapper-parity.sh && bash tests/native-installer/test-spark-maintenance.sh && node --test tests/npm-installer/cli.test.mjs"

17 },

18 "files": [

19 "bin",

20 "src",

21 "skills",

22 "hooks",

23 ".claude-plugin",

24 ".codex-plugin",

25 ".cursor-plugin",

26 ".kimi-plugin",

27 ".opencode",

28 ".pi",

29 "assets",

30 "README.md",

31 "CLAUDE.md",

32 "GEMINI.md",

33 "CODE_OF_CONDUCT.md",

skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

bin/spark-install.shView file

•path = bin/spark-install.sh kind = build_helper sizeBytes = 37429 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/spark-install.shView on unpkg

skills/.system/skill-creator/scripts/init_skill.pyView file

•path = skills/.system/skill-creator/scripts/init_skill.py kind = payload_in_excluded_dir sizeBytes = 14602 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/.system/skill-creator/scripts/init_skill.pyView on unpkg

src/cli/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @adityaaria/spark@6.1.4 matchedIdentity = npm:QGFkaXR5YWFyaWEvc3Bhcms:6.1.4 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/install.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code