registry  /  @aiaiai-pt/martha-cli  /  0.29.0

@aiaiai-pt/martha-cli@0.29.0

Terminal-first client for the Martha AI platform

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 769 KB of source, external domains: 127.0.0.1, auth.nomadriver.co, denied.example.invalid, martha.nomadriver.co, registry.npmjs.org, www.googleapis.com

Source & flagged code

4 flagged · loading source
dist/index.jsView file
752var EventEmitter = __require("node:events").EventEmitter; L753: var childProcess = __require("node:child_process"); L754: var path = __require("node:path");
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L752
1212} L1213: const execArgv = process2.execArgv ?? []; L1214: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1212
21357const body = fs12.readFileSync(skillPath, "utf-8"); L21358: process.stdout.write(body); L21359: } ... L21366: // src/commands/update.ts L21367: import { spawnSync } from "node:child_process"; L21368: import { realpathSync } from "node:fs"; ... L21371: var PKG = "@aiaiai-pt/martha-cli"; L21372: var LATEST_URL = "https://registry.npmjs.org/@aiaiai-pt%2Fmartha-cli/latest"; L21373: function compareSemver2(a, b) {
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L21357
29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L29

Findings

3 High3 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings