registry / @aide-dev/aide / 2.0.1

@aide-dev/aide@2.0.1

AIDE - AI coding quality inspector: detect hallucinations, stub code, and errors in AI-generated code

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 790 KB of source, external domains: api.anthropic.com, api.example.com, api.minimax.chat, api.openai.com, crates.io, dashscope.aliyuncs.com, open.bigmodel.cn, proxy.golang.org, pypi.org, registry.npmjs.org, rubygems.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 94-134javascript

94 this.cache.clear();

95 this.diskCache = {};

96 this.diskCacheDirty = false;

97 }

98 /** 将脏数据写入磁盘缓存 */

99 flushDiskCache() {

100 if (!this.diskCacheDirty || !this.diskCachePath) return;

101 try {

102 const dir = dirname(this.diskCachePath);

103 if (!existsSync(dir)) mkdirSync(dir, { recursive: true });

104 writeFileSync(this.diskCachePath, JSON.stringify(this.diskCache, null, 2), "utf-8");

105 this.diskCacheDirty = false;

106 } catch {

107 }

108 }

109 /** 加载磁盘缓存 */

110 loadDiskCache() {

111 if (!this.diskCachePath) return;

112 try {

113 if (!existsSync(this.diskCachePath)) return;

114 const data = readFileSync(this.diskCachePath, "utf-8");

115 const parsed = JSON.parse(data);

116 if (typeof parsed === "object" && parsed !== null) {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L114

117 this.diskCache = parsed;

118 const now = Date.now();

119 for (const [key, entry] of Object.entries(this.diskCache)) {

120 if (entry.cachedAt && now - entry.cachedAt >= DISK_CACHE_TTL) {

121 delete this.diskCache[key];

122 }

123 }

124 }

125 } catch {

126 }

127 }

128 async queryRegistry(packageName, language) {

129 switch (language) {

130 case "python":

131 return this.checkPyPI(packageName);

132 case "typescript":

133 case "javascript":

134 return this.checkNpm(packageName);

Lines 1074-1114javascript

1074}

1075function extractRustImportsAndExports(source, imports, exports) {

1076 const useRegex = /use\s+[\w:]+::(\w+)/g;

1077 let match;

1078 while ((match = useRegex.exec

Lines 9942-9982javascript

9942 let match;

9943 while ((match = regex.exec(code)) !== null) {

9944 const line = getLineNumber(code, match.index);

9945 if (isInNonCode(code, match.index)) continue;

9946 issues.push({

9947 rule:

Source & flagged code

3 flagged · loading source

dist/index.jsView file

114const data = readFileSync(this.diskCachePath, "utf-8"); L115: const parsed = JSON.parse(data); L116: if (typeof parsed === "object" && parsed !== null) { ... L147: try { L148: const url = `https://registry.npmjs.org/${encodeURIComponent(name)}`; L149: const res = await fetch(url, { ... L512: } L513: const classMatch = trimmed.match(/(?:public|protected|private)?\s*(?:static\s+)?(?:abstract\s+)?(?:final\s+)?class\s+(\w+)/); L514: if (classMatch) { ... L696: // src/core/python-ast-bridge.ts L697: import { spawnSync } from "child_process"; L698: var PYTHON_SCRIPT = `

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L114

1094function extractRubyImportsAndExports(source, imports, exports) { L1095: const requireRegex = /require(?:_relative)?\s+['"]([^'"]+)['"]/g; L1096: let match;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1094

9962if (language === "python") { L9963: evalPatterns.push({ regex: /\beval\s*\(/g, message: "\u4F7F\u7528 eval()\uFF0C\u5B58\u5728\u5B89\u5168\u98CE\u9669" }); L9964: evalPatterns.push({ regex: /\bexec\s*\(/g, message: "\u4F7F\u7528 exec()\uFF0C\u5B58\u5728\u5B89\u5168\u98CE\u9669" });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L9962

Findings

1 High4 Medium5 Low

HighObfuscated Payload Loaderdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 94-134javascript

94 this.cache.clear();

95 this.diskCache = {};

96 this.diskCacheDirty = false;

97 }

98 /** 将脏数据写入磁盘缓存 */

99 flushDiskCache() {

100 if (!this.diskCacheDirty || !this.diskCachePath) return;

101 try {

102 const dir = dirname(this.diskCachePath);

103 if (!existsSync(dir)) mkdirSync(dir, { recursive: true });

104 writeFileSync(this.diskCachePath, JSON.stringify(this.diskCache, null, 2), "utf-8");

105 this.diskCacheDirty = false;

106 } catch {

107 }

108 }

109 /** 加载磁盘缓存 */

110 loadDiskCache() {

111 if (!this.diskCachePath) return;

112 try {

113 if (!existsSync(this.diskCachePath)) return;

114 const data = readFileSync(this.diskCachePath, "utf-8");

115 const parsed = JSON.parse(data);

116 if (typeof parsed === "object" && parsed !== null) {

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L114

117 this.diskCache = parsed;

118 const now = Date.now();

119 for (const [key, entry] of Object.entries(this.diskCache)) {

120 if (entry.cachedAt && now - entry.cachedAt >= DISK_CACHE_TTL) {

121 delete this.diskCache[key];

122 }

123 }

124 }

125 } catch {

126 }

127 }

128 async queryRegistry(packageName, language) {

129 switch (language) {

130 case "python":

131 return this.checkPyPI(packageName);

132 case "typescript":

133 case "javascript":

134 return this.checkNpm(packageName);

Lines 1074-1114javascript

1074}

1075function extractRustImportsAndExports(source, imports, exports) {

1076 const useRegex = /use\s+[\w:]+::(\w+)/g;

1077 let match;

1078 while ((match = useRegex.exec

Lines 9942-9982javascript

9942 let match;

9943 while ((match = regex.exec(code)) !== null) {

9944 const line = getLineNumber(code, match.index);

9945 if (isInNonCode(code, match.index)) continue;

9946 issues.push({

9947 rule: