registry / @bastani/atomic / 0.9.4

@bastani/atomic@0.9.4

Atomic coding agent CLI with read, bash, edit, write tools and session management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,229 file(s), 9.65 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.enterprise.githubcopilot.com, api.exa.ai, api.github.com, api.githubcopilot.com, api.individual.githubcopilot.com, api.perplexity.ai, api2.cursor.sh, atomic.sh, cdn.jsdelivr.net, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, content-push.googleapis.com, cursor.com, distro.ibiblio.org, dribbble.com, example.com, fonts.googleapis.com, fonts.gstatic.com, gemini.google.com, generativelanguage.googleapis.com, git-scm.com, github.com, gitlab.com, img.youtube.com, impeccable.style, json-schema.org, mariozechner.at, mcp.exa.ai, mistral.ai, motionsites.ai, perplexity.ai, pi.dev, r.jina.ai, recent.design, registry.npmjs.org, shittycodingagent.ai, www.awwwards.com, www.google.com, www.monet.design, www.w3.org, www.youtube.com

Source & flagged code

6 flagged

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/tools/search-native.jsView file

Lines 1-27javascript

1import { createModuleRequire } from "../../utils/module-require.js";

2let cachedLoadResult = null;

3export function resetNativeSearchBindingCache() {

4 cachedLoadResult = null;

6export function loadNativeSearchBinding

dist/builtin/workflows/skills/impeccable/scripts/live/svelte-component.mjsView file

Lines 1-40javascript

1/**

2 * Svelte live-mode component injection helpers.

3 *

4 * Variants are real .svelte components under node_modules/.impeccable-live/<session-id>/.

5 * The browser mounts them via Svelte 5 mount(); accept inlines the chosen

6 * variant back into the route source with props mapped to original bindings.

7 */

9import fs from 'node:fs';

10import

dist/core/tools/fetch-url.jsView file

Lines 1-36javascript

1/// <reference path="../../utils/turndown.d.ts" />

2/**

3 * URL fetch / cache / artifact / markdown-discovery pipeline, mirrored from

4 * oh-my-pi's `packages/coding-agent/src/tools/fetch.ts` at 15b5c1397fc.

5 *

6 * Responsibilities:

7 * - parseReadUrlTarget: URL + line selectors (:raw, :N, :A-B, :A+B, :A-B,C-D),

8 * collapsed-scheme repair, host-port protection.

9 * - session-scoped LRU cache keyed by `<scope>::<raw|rendered>::<normalizedUrl>`,

10 * cached under both requested and final (redirected) URLs.

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView file

•path = [redacted]-for-text.sh kind = build_helper sizeBytes = 2138 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView on unpkg

dist/core/tools/bash.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bastani/atomic@0.9.3 matchedIdentity = npm:QGJhc3RhbmkvYXRvbWlj:0.9.3 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/tools/bash.jsView on unpkg

Source & flagged code

6 flagged · loading source

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/tools/search-native.jsView file

9try { L10: const require = createModuleRequire(import.meta.url); L11: const binding = require("@bastani/atomic-natives");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/tools/search-native.jsView on unpkg · L9

dist/builtin/workflows/skills/impeccable/scripts/live/svelte-component.mjsView file

20export function [redacted](filePath) { L21: if (/^(0|false|no)$/i.test(process.env.IMPECCABLE_LIVE_SVELTE_COMPONENT || '')) return false; L22: return path.extname(filePath).toLowerCase() === '.svelte'; ... L24: L25: export function componentSessionDir(id, cwd = process.cwd()) { L26: return path.join(cwd, SVELTE_COMPONENT_ROOT, id); ... L255: export function readManifest(manifestPath) { L256: const data = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')); L257: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/builtin/workflows/skills/impeccable/scripts/live/svelte-component.mjsView on unpkg · L20

dist/core/tools/fetch-url.jsView file

16*/ L17: import { lookup } from "node:dns/promises"; L18: import { ipFamily, isPrivateIpAddress, normalizeIpLiteralHost } from "./url-ip-guards.js"; L19: import { LRUCache } from "lru-cache"; ... L204: throw new Error(`Unsupported URL protocol: ${parsed.protocol}`); L205: if (process.env.ATOMIC_ALLOW_PRIVATE_URL_READS === "1") L206: return undefined; ... L226: if (!response.body) { L227: const buffer = Buffer.from(await response.arrayBuffer()); L228: if (buffer.length > MAX_URL_RESPONSE_BYTES)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/core/tools/fetch-url.jsView on unpkg · L16

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView file

•path = [redacted]-for-text.sh kind = build_helper sizeBytes = 2138 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView on unpkg

dist/core/tools/bash.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/tools/bash.jsView on unpkg

Findings

2 High5 Medium7 Low

HighCloud Metadata Accessdist/core/tools/fetch-url.js

HighPrevious Version Dangerous Deltadist/core/tools/bash.js

MediumDynamic Requiredist/core/tools/search-native.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/builtin/subagents/skills/tmux/scripts/wait-for-text.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowWeak Cryptodist/builtin/workflows/skills/impeccable/scripts/live/svelte-component.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/tools/search-native.jsView file

Lines 1-27javascript

1import { createModuleRequire } from "../../utils/module-require.js";

2let cachedLoadResult = null;

3export function resetNativeSearchBindingCache() {

4 cachedLoadResult = null;

6export function loadNativeSearchBinding

dist/builtin/workflows/skills/impeccable/scripts/live/svelte-component.mjsView file

Lines 1-40javascript

1/**

2 * Svelte live-mode component injection helpers.

3 *

4 * Variants are real .svelte components under node_modules/.impeccable-live/<session-id>/.

5 * The browser mounts them via Svelte 5 mount(); accept inlines the chosen

6 * variant back into the route source with props mapped to original bindings.

7 */

9import fs from 'node:fs';

10import

dist/core/tools/fetch-url.jsView file

Lines 1-36javascript

1/// <reference path="../../utils/turndown.d.ts" />

2/**

3 * URL fetch / cache / artifact / markdown-discovery pipeline, mirrored from

4 * oh-my-pi's `packages/coding-agent/src/tools/fetch.ts` at 15b5c1397fc.

5 *

6 * Responsibilities:

7 * - parseReadUrlTarget: URL + line selectors (:raw, :N, :A-B, :A+B, :A-B,C-D),

8 * collapsed-scheme repair, host-port protection.

9 * - session-scoped LRU cache keyed by `<scope>::<raw|rendered>::<normalizedUrl>`,

10 * cached under both requested and final (redirected) URLs.

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView file

•path = [redacted]-for-text.sh kind = build_helper sizeBytes = 2138 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/builtin/subagents/skills/tmux/scripts/wait-for-text.shView on unpkg

dist/core/tools/bash.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/tools/bash.jsView on unpkg