@alumbwe/anvil@1.0.18

⚠ Under review

Anvil is a free AI coding assistant for your terminal. It can inspect a project, edit files, and run commands while keeping the public product name and command as `anvil`.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 1 file(s), 257 KB of source, external domains: bun.sh, cdn.jsdelivr.net, codebuff.com, posthog.codebuff.test, registry.npmjs.org, stripe.codebuff.test, unpkg.com

Oversized source lightweight scan

dist/bundled.js7.15 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalShellHighEntropyStringsTelemetryUrlStringscdn.jsdelivr.netcodebuff.composthog.codebuff.testregistry.npmjs.orgstripe.codebuff.testunpkg.com

Source & flagged code

6 flagged

bin/anvil.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * npm bin wrapper — launches the bundled CLI via bun.

4 *

5 * npm rejects shebangs other than `node`, so this thin shim exec's bun

6 * with the bundled entry point. When the user has bun installed globally

7 * (`npm i -g bun`) the CLI works out of the box.

8 */

9const { spawnSync } = require('child_process')

10const path = require('path')

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

11const fs = require('fs')

13const bundledPath = path.join(__dirname, '..', 'dist', 'bundled.js')

15if (!fs.existsSync(bundledPath)) {

16 console.error(

17 'Error: bundled CLI not found at ' +

18 bundledPath +

19 '\n' +

20 'Try reinstalling: npm i -g @alumbwe/anvil',

21 )

22 process.exit(1)

23}

25// bundled.js targets Bun. Running it with Node produces misleading module

26// loader errors, so fail clearly instead of attempting an unsupported fallback.

27const child = spawnSync('bun', [bundledPath, ...process.argv.slice(2)], {

28 stdio: 'inherit',

dist/bundled.jsView file

•context = } -ErrorAction Stop } catch {}; ` + `if (Test-Path -LiteralPath ${psQuote(options2.disarmPath)}) { ` + `Remove-Item -LiteralPath ${psQuote(options2.disarmPath)} -Force -ErrorAction SilentlyContinue ` + `} else { ` + `$b=[byte[]](${payloadBytes}); ` + `${writeResets} }; ` + `Remove-Item -LiteralPath ${psQuote(options2.armedPath)} -Force -ErrorAction SilentlyContinue`;\n const powershell = options2.powershellPath ?? path33.join(getCliEnv().SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");\n const watchdogArgs = `-NoProfile -NonInteractive -Command "${watchdogScript}"`;\n const bootstrapScript = `Start-Process -FilePath ${psQuote(powershell)} ` + `-ArgumentList ${psQuote(watchdogArgs)} -NoNewWindow`;\n return spawn6(powershell, ["-NoProfile

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_source_file sizeBytes = 7493031 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_cli_entrypoint sizeBytes = 7493031 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bundled.jsView on unpkg

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

Source & flagged code

6 flagged · loading source

bin/anvil.cjsView file

8*/ L9: const { spawnSync } = require('child_process') L10: const path = require('path')

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

dist/bundled.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

Findings

1 Critical2 High7 Medium8 Low

CriticalEncrypted Payload Temp Executiondist/bundled.js

HighChild Processbin/anvil.cjs

HighShell

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/vendor/ripgrep/x64-darwin/rg

MediumShips Wasm Modulebin/tree-sitter.wasm

MediumOversized Source Filedist/bundled.js

MediumOversized Cli Entrypointdist/bundled.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @alumbwe/anvil@1.0.18.

See all versions of @alumbwe/anvil for other recorded verdicts.

Review the evidence and your use of @alumbwe/anvil@1.0.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 20:26:32.692Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.