registry / @babylonjs-toolkit/agent / 1.1.26

@babylonjs-toolkit/agent@1.1.26

⚠ Under review

Installs the Babylon Toolkit Desktop Agent for Claude Code, Codex, GitHub Copilot, Gemini CLI and Antigravity.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 86.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 78.4 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged

package.jsonView file

Lines 15-46json

15 "url": "https://github.com/babylontoolkit/skills/issues"

16 },

17 "repository": {

18 "type": "git",

19 "url": "git+https://github.com/babylontoolkit/skills.git"

20 },

21 "license": "MIT",

22 "author": "Mackey Kinard",

23 "bin": {

24 "bt-agent": "bin/bt-agent.js"

25 },

26 "files": [

27 "skills",

28 "bin",

29 "lib",

30 "scripts",

31 "persona.md",

32 ".codex/config.toml"

33 ],

34 "scripts": {

35 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "deploy-all": "npm publish --access public",

37 "test": "node --test tests/*.test.js"

38 },

39 "engines": {

40 "node": ">=18"

41 },

42 "publishConfig": {

43 "access": "public"

44 }

45}

lib/targets.jsView file

Lines 1-21javascript

1'use strict';

3const { resolveTargetPath } = require('./paths');

5/**

6 * The install target matrix.

7 *

8 * Adding support for another AI client is one entry here — no other file changes.

skills/bt-atlas/scripts/preview.pyView file

•path = skills/bt-atlas/scripts/preview.py kind = build_helper sizeBytes = 2478 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/bt-atlas/scripts/preview.pyView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

@babylonjs-toolkit/agent@1.1.26

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code