registry  /  @aiaiai-pt/martha-cli  /  0.45.0

@aiaiai-pt/martha-cli@0.45.0

Terminal-first client for the Martha AI platform

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 810 KB of source, external domains: 127.0.0.1, auth.nomadriver.co, denied.example.invalid, martha.nomadriver.co, registry.npmjs.org, www.googleapis.com

Source & flagged code

4 flagged · loading source
dist/index.jsView file
770var EventEmitter = __require("node:events").EventEmitter; L771: var childProcess = __require("node:child_process"); L772: var path = __require("node:path");
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L770
1230} L1231: const execArgv = process2.execArgv ?? []; L1232: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1230
22350const body = fs12.readFileSync(skillPath, "utf-8"); L22351: process.stdout.write(body); L22352: } ... L22359: // src/commands/update.ts L22360: import { spawnSync } from "node:child_process"; L22361: import { realpathSync } from "node:fs"; ... L22364: var PKG = "@aiaiai-pt/martha-cli"; L22365: var LATEST_URL = "https://registry.npmjs.org/@aiaiai-pt%2Fmartha-cli/latest"; L22366: function compareSemver2(a, b) {
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L22350
47var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L48: var __require = /* @__PURE__ */ createRequire(import.meta.url); L49:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L47

Findings

3 High3 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings