registry / @altimateai/altimate-code / 0.9.2

@altimateai/altimate-code@0.9.2

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 884 KB of source, external domains: altimate-code.dev, github.com, goo.gl, jimmy.warting.se

Source & flagged code

9 flagged

package.jsonView file

Lines 1-28json

2 "name": "@altimateai/altimate-code",

3 "bin": {

4 "altimate": "./bin/altimate",

5 "altimate-code": "./bin/altimate-code"

6 },

7 "scripts": {

8 "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 },

10 "version": "0.9.2",

11 "license": "MIT",

12 "dependencies": {

13 "@altimateai/altimate-core": "0.5.1"

14 },

15 "optionalDependencies": {

16 "@altimateai/altimate-code-linux-arm64": "0.9.2",

17 "@altimateai/altimate-code-linux-x64-baseline": "0.9.2",

18 "@altimateai/altimate-code-linux-x64": "0.9.2",

19 "@altimateai/altimate-code-windows-x64": "0.9.2",

20 "@altimateai/altimate-code-darwin-x64-baseline": "0.9.2",

21 "@altimateai/altimate-code-darwin-arm64": "0.9.2",

22 "@altimateai/altimate-code-darwin-x64": "0.9.2",

23 "@altimateai/altimate-code-windows-x64-baseline": "0.9.2"

24 },

25 "peerDependencies": {

26 "pg": ">=8",

27 "snowflake-sdk": ">=1",

28 "@google-cloud/bigquery": ">=8",

dbt-tools/dist/index.jsView file

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path";

High

Child Process

Package source references child process execution.

dbt-tools/dist/index.jsView on unpkg · L68

24057// src/index.ts L24058: import { join as join8, resolve as resolve4 } from "path"; L24059: import { existsSync as existsSync7 } from "fs"; ... L24065: import { existsSync } from "fs"; L24066: import { execFileSync } from "child_process"; L24067: function configDir() { L24068: return join(process.env.HOME || homedir(), ".altimate-code"); L24069: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dbt-tools/dist/index.jsView on unpkg · L24057

2028var methodName = "on" + name.toLowerCase(); L2029: var method = util.global[methodName]; L2030: if (!method)

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dbt-tools/dist/index.jsView on unpkg · L2028

dbt-tools/dist/node_python_bridge.pyView file

•path = dbt-tools/dist/node_python_bridge.py kind = build_helper sizeBytes = 3745 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dbt-tools/dist/node_python_bridge.pyView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code