registry / @aizakmi08/machiai / 0.1.22

@aizakmi08/machiai@0.1.22

Chess for people waiting on AI agents.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 484 KB of source, external domains: 127.0.0.1, api.x.com, machiai-aizakmi08.onrender.com, reactjs.org, www.w3.org, x.com

Source & flagged code

4 flagged

dist/packages/cli/src/agent.jsView file

Lines 17-57javascript

17 const started = new Promise((resolve, reject) => {

18 child.once("spawn", resolve);

19 child.once("error", reject);

20 });

21 const done = new Promise((resolve) => {

22 child.once("error", (error) => {

23 onOutput(`\nAgent failed to start: ${error.message}\n`);

24 resolve({ code: 127, signal: null });

25 });

26 child.once("exit", (code, signal) => resolve({ code, signal }));

27 });

28 return {

29 started,

30 done,

31 kill: (signal = "SIGTERM") => child.kill(signal),

32 };

33}

34function tryStartPty(command, args, onOutput) {

35 if (process.env.MACHIAI_DISABLE_PTY === "1")

36 return undefined;

37 try {

38 const req = eval("require");

39 const pty = req("node-pty");

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/packages/cli/src/agent.jsView on unpkg · L37

40 const proc = pty.spawn(command, args, {

41 cwd: process.cwd(),

42 env: process.env,

43 cols: process.stdout.columns || 80,

44 rows: process.stdout.rows || 24,

45 });

46 proc.onData(onOutput);

47 const done = new Promise((resolve) => {

48 proc.onExit((event) => resolve({ code: event.exitCode, signal: null }));

49 });

50 return {

51 started: Promise.resolve(),

52 done,

53 kill: (signal = "SIGTERM") => proc.kill(signal),

54 };

55 }

56 catch {

57 return undefined;

dist/packages/cli/src/app.jsView file

Lines 1-27javascript

1import { spawn } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, resolve } from "node:path"

scripts/quickstart.shView file

•path = scripts/quickstart.sh kind = build_helper sizeBytes = 1854 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/quickstart.shView on unpkg

dist/apps/overlay/src/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aizakmi08/machiai@0.1.20 matchedIdentity = npm:QGFpemFrbWkwOC9tYWNoaWFp:0.1.20 similarity = 0.879 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/apps/overlay/src/main.jsView on unpkg

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code