registry / @aisystemresources/emdee / 0.1.1

@aisystemresources/emdee@0.1.1

Local-first document management with markdown rendering, knowledge graph, and MCP server.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 57 file(s), 304 KB of source, external domains: github.com

Source & flagged code

2 flagged

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn } from "node:child_process";

4import { mkdir, writeFile, access } from "node:fs/promises";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

5import readline from "node:readline/promises";

6import path from "node:path";

7import { fileURLToPath } from "node:url";

9const __dirname = path.dirname(fileURLToPath(import.meta.url));

10const pkgRoot = path.resolve(__dirname, "..");

12// SPRINT-090: `start` and `serve-next` shell out to Vite / Next.js against

13// the full repo. Those files (app/, next.config.*, etc.) aren't in the

14// published tarball, so when the CLI is installed via `npm install -g`

15// those commands need to bail loudly rather than crash with a confusing

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/emdee.jsView on unpkg · L2

16// Vite / Next stack.

17async function ensureRepoCheckout(commandName) {

18 try {

19 await access(path.join(pkgRoot, "app"));

20 } catch {

21 console.error(

22 `emdee ${commandName} requires a repo checkout — clone https://github.com/AISystemResources/emdee\n` +

Source & flagged code

2 flagged · loading source

bin/emdee.jsView file

2import { Command } from "commander"; L3: import { spawn } from "node:child_process"; L4: import { mkdir, writeFile, access } from "node:fs/promises";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code