registry / @axiomantic/rhizo / 0.1.8

@axiomantic/rhizo@0.1.8

⚠ Under review

Inter-assistant communication bus, monotonic fencing locks, and work queues over Redis

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 32.1 KB of source, external domains: github.com, nim-lang.org

Source & flagged code

6 flagged

bin/run.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const os = require('os');

5const { spawnSync, execSync } = require('child_process');

7const PKG_NAME = 'rhizo';

8const REPO = `axiomantic/${PKG_NAME}`;

9const VERSION = require('../package.json').version;

11function isCompatibleBinary(filePath) {

12 try {

13 if (!fs.existsSync(filePath)) return false;

14 const stat = fs.statSync(filePath);

15 if (!stat.isFile() || stat.size < 64) return false;

17 const fd = fs.openSync(filePath, 'r');

18 const buf = Buffer.alloc(64);

19 fs.readSync(fd, buf, 0, 64, 0);

20 fs.closeSync(fd);

22 const platform = process.platform;

23 const arch = process.arch;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @axiomantic/rhizo@0.1.5 matchedIdentity = npm:QGF4aW9tYW50aWMvcmhpem8:0.1.5 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/run.jsView on unpkg

bin/binaries/rhizo-darwin-arm64View file

•path = bin/binaries/rhizo-darwin-arm64 kind = native_binary sizeBytes = 1163008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/binaries/rhizo-darwin-arm64View on unpkg

scripts/ci/build.shView file

•path = scripts/ci/build.sh kind = build_helper sizeBytes = 1039 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ci/build.shView on unpkg

skills/rhizo/opencode-ear.jsView file

•matchType = normalized_sha256 matchedPackage = @axiomantic/rhizo@0.1.4 matchedPath = skills/rhizo/opencode-ear.js matchedIdentity = npm:QGF4aW9tYW50aWMvcmhpem8:0.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/rhizo/opencode-ear.jsView on unpkg

skills/rhizo/pi-ear.tsView file

•matchType = normalized_sha256 matchedPackage = @axiomantic/rhizo@0.1.4 matchedPath = skills/rhizo/pi-ear.ts matchedIdentity = npm:QGF4aW9tYW50aWMvcmhpem8:0.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/rhizo/pi-ear.tsView on unpkg

Source & flagged code

6 flagged · loading source

bin/run.jsView file

@axiomantic/rhizo@0.1.8

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code