registry / @big-emotion/ferry / 0.18.0

@big-emotion/ferry@0.18.0

Ferry — GitHub Actions–native agent pipeline for Jira-driven automated development

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 939 KB of source, external domains: acme.atlassian.net, admin.atlassian.com, api.github.com, console.anthropic.com, console.cloud.google.com, docs.github.com, ferry.dev, fetch.spec.whatwg.org, github.com, gitlab.com, id.atlassian.com, json-schema.org, mcp.context7.com, platform.openai.com, uploads.github.com

Source & flagged code

4 flagged

dist/cli/init/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/cli/init/index.ts

4import { execSync as execSync4 } from "node:child_process";

5import { existsSync as existsSync3, writeFileSync as writeFileSync4 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/init/index.jsView on unpkg · L3

6import { join as join4 } from "node:path";

8// src/cli/init/prompt.ts

9import { createInterface } from "node:readline/promises";

10import { stdin as input, stdout as output } from "node:process";

11var _rl = null;

12function rl() {

13 if (!_rl) {

14 _rl = createInterface({ input, output, terminal: false });

15 }

16 return _rl;

17}

18async function ask(question, defaultValue) {

19 const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

20 const answer = await rl().question(prompt);

21 const trimmed = answer.trim();

22 return trimmed || defaultValue || "";

23}

dist/cli/agent/run.jsView file

Lines 269-309javascript

269function byPrHeadSha(role, headSha) {

270 return `[ferry:${role}:${headSha.slice(0, 7)}]`;

271}

Source & flagged code

4 flagged · loading source

dist/cli/init/index.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code