registry / @aggroot-team/aggroot / 1.13.5
@aggroot-team/aggroot@1.13.5
⚠ Under reviewAggRoot - AI Assistant (Node.js/TypeScript Version)
Static Scan Results
scanned 15d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Oversized source lightweight scan
dist/index.cjs9.97 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsMinified
Source & flagged code
9 flaggeddist/cli.cjsView file
2// AggRoot CLI wrapper - ensures Node.js heap is large enough for long sessions.
L3: const v8 = require('node:v8');
L4: const path = require('node:path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli.cjsView on unpkg · L2dist/native/better_sqlite3.nodeView file
•path = dist/native/better_sqlite3.node
kind = native_binary
sizeBytes = 1919488
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
dist/native/better_sqlite3.nodeView on unpkgdist/tree-sitter-c.wasmView file
•
Findings
3 High9 Medium6 Low
HighSemantic Analysis Limitedscripts/test-tokenizer.js
HighKnown Malware Source Similarityshare/web/dist/assets/chunk-AQP2D5EJ-CWq9KDya.js
HighKnown Malware Source Similarityshare/web/dist/assets/flowDiagram-I6XJVG4X-_qTv9rPx.js
MediumDynamic Requiredist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/native/better_sqlite3.node
MediumShips Wasm Moduledist/tree-sitter-c.wasm
MediumShips Build Helperinstall-windows.bat
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @aggroot-team/aggroot@1.13.5.
See all versions of @aggroot-team/aggroot for other recorded verdicts.
- Review the evidence and your use of @aggroot-team/aggroot@1.13.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.