registry / @aitherium/awsh / 1.18.6
@aitherium/awsh@1.18.6
awsh - your terminal answers you. Type a question where a command would go, and get an answer instead of "command not found".
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/repl.jsView file
14import * as readline from 'node:readline';
L15: import { execSync } from 'node:child_process';
L16: import { existsSync, readFileSync, appendFileSync, mkdirSync } from 'node:fs';
High
688else if (!shellCmd) {
L689: console.log(chalk.yellow(' Usage: !command (run in PowerShell 7)'));
L690: console.log(chalk.dim(' !! repeats last shell command'));
High
794patternName = generic_password
severity = medium
line = 794
matchedText = pw = (aw...m();
Medium
dist/crash-reporter.jsView file
Findings
8 High4 Medium4 Low
HighChild Processdist/repl.js
HighShelldist/repl.js
HighSame File Env Network Executiondist/crash-reporter.js
HighCredential Redirect Persistencedist/commands.js
HighEntrypoint Foreign Package Code Overwritedist/commands.js
HighCommand Output Exfiltrationdist/commands.js
HighSandbox Evasion Gated Capabilitydist/commands.js
HighRuntime Package Installdist/commands.js
MediumSecret Patterndist/repl.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @aitherium/awsh@1.18.6.
See all versions of @aitherium/awsh for other recorded verdicts.
- Review the evidence and your use of @aitherium/awsh@1.18.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.