registry / @apmantza/greedysearch-pi / 2.1.4

@apmantza/greedysearch-pi@2.1.4

Headless multi-engine AI search (Perplexity, Google AI, ChatGPT, Gemini) via browser automation. NO API KEYS needed. Grounded all-engine search fetches sources by default, with optional configurable synthesis and deep research.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 630 KB of source, external domains: api.github.com, arxiv.org, chatgpt.com, clerk.consensus.app, consensus.app, copilot.microsoft.com, docs.example.com, doi.org, example.com, facebook.com, gemini.google.com, github.com, logically.app, raw.githubusercontent.com, react.dev, www.facebook.com, www.google.com, www.perplexity.ai, www.semanticscholar.org, x.com

Source & flagged code

4 flagged

test.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// test.mjs — Cross-platform test runner for GreedySearch (Windows + Unix)

3//

4// Usage:

5// node test.mjs # run all tests (~8-12 min)

6// node test.mjs quick # skip slow tests (~3 min)

7// node test.mjs smoke # basic health check (~60s)

8// node test.mjs parallel # race condition tests only

9// node test.mjs flags # flag/option tests only

10// node test.mjs edge # edge case tests only

11// node test.mjs unit # fast unit tests only (no Chrome needed)

12// node test.mjs synth # synthesis config smoke (gemini + chatgpt)

14import { spawn } from "node:child_process";

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

test.mjsView on unpkg · L13

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

test.mjsView on unpkg · L13

16import { dirname, join } from "node:path";

17import { fileURLToPath } from "node:url";

19const __dir = dirname(fileURLToPath(import.meta.url));

21// ANSI colors

22const C = {

23 red: "\x1b[31m",

24 green: "\x1b[32m",

25 yellow: "\x1b[33m",

26 blue: "\x1b[34m",

27 cyan: "\x1b[36m",

28 reset: "\x1b[0m",

29};

31const mode = process.argv[2] || "all";

32const resultsDir = join(__dir, "results", `test_${Date.now()}`);

33mkdirSync(resultsDir, { recursive: true });

src/utils/system-cmds.mjsView file

Lines 1-36javascript

1// src/utils/system-cmds.mjs — Resolve system utilities to absolute paths

2//

3// Using absolute paths for system commands prevents PATH-injection risks

4// and satisfies SonarCloud security hotspot requirements.

6import { execSync } from "node:child_process";

7import { existsSync } from "node:fs";

scripts/run-tests.ps1View file

•path = scripts/run-tests.ps1 kind = build_helper sizeBytes = 6276 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-tests.ps1View on unpkg

Source & flagged code

4 flagged · loading source

test.mjs

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code