registry / @ai-dev-methodologies/rlp-desk / 0.22.13

@ai-dev-methodologies/rlp-desk@0.22.13

Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 280 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-26json

2 "name": "@ai-dev-methodologies/rlp-desk",

3 "version": "0.22.13",

4 "description": "Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification",

5 "scripts": {

6 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L6

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L6

7 "uninstall": "node scripts/uninstall.js",

8 "manifest:check": "node scripts/build-node-manifest.js --check",

9 "prepublishOnly": "node scripts/build-node-manifest.js --check",

10 "test:node": "node --test 'tests/node/*.mjs' 'tests/node/*.test.mjs'",

11 "test:zsh": "for f in tests/test_*.sh; do echo \"=== $f ===\"; case \"$(head -1 \"$f\")\" in *zsh*) zsh \"$f\";; *) bash \"$f\";; esac || exit 1; done",

12 "test:fast": "npm run test:node",

13 "test:full": "npm run test:fast && npm run test:zsh",

14 "sv-gate:fast": "zsh tests/sv-gate-fast.sh",

15 "sv-gate:full": "zsh tests/sv-gate-full.sh"

16 },

17 "files": [

18 "src/commands/",

19 "src/node/",

20 "src/scripts/",

21 "!src/scripts/.run_src_verify.zsh",

22 "src/governance.md",

23 "src/model-upgrade-table.md",

24 "scripts/",

25 "docs/rlp-desk/*.md",

26 "docs/rlp-desk/blueprints/",

scripts/postinstall.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("fs");

5const path = require("path");

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/node/reporting/campaign-reporting.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-dev-methodologies/rlp-desk@0.22.10 matchedIdentity = npm:[redacted]:0.22.10 similarity = 0.840 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/node/reporting/campaign-reporting.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code