registry  /  @andresmassello/uscha  /  1.40.2

@andresmassello/uscha@1.40.2

Uscha installer for Codex and Claude coding-agent workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcess
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 887 B of source

Source & flagged code

5 flagged · loading source
uscha-kit/tests/smoke-engine.shView file
591patternName = aws_access_key severity = critical line = 591 matchedText = printf -...diff
Critical
Critical Secret

Package contains a critical-looking secret pattern.

uscha-kit/tests/smoke-engine.shView on unpkg · L591
591patternName = aws_access_key severity = critical line = 591 matchedText = printf -...diff
Critical
Secret Pattern

AWS access key ID in uscha-kit/tests/smoke-engine.sh

uscha-kit/tests/smoke-engine.shView on unpkg · L591
593patternName = private_key_rsa severity = critical line = 593 matchedText = printf -...diff
Critical
Secret Pattern

RSA private key in uscha-kit/tests/smoke-engine.sh

uscha-kit/tests/smoke-engine.shView on unpkg · L593
path = uscha-kit/tests/smoke-engine.sh kind = payload_in_excluded_dir sizeBytes = 112083 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

uscha-kit/tests/smoke-engine.shView on unpkg
uscha-kit/workbench-doctor.shView file
path = uscha-kit/workbench-doctor.sh kind = build_helper sizeBytes = 1578 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uscha-kit/workbench-doctor.shView on unpkg

Findings

3 Critical1 High2 Medium
CriticalCritical Secretuscha-kit/tests/smoke-engine.sh
CriticalSecret Patternuscha-kit/tests/smoke-engine.sh
CriticalSecret Patternuscha-kit/tests/smoke-engine.sh
HighPayload In Excluded Diruscha-kit/tests/smoke-engine.sh
MediumShips Build Helperuscha-kit/workbench-doctor.sh
MediumStructural Risk Force Deep Review