registry / @big-emotion/ferry / 1.0.2

@big-emotion/ferry@1.0.2

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 1.00 MB of source, external domains: acme.atlassian.net, admin.atlassian.com, api.github.com, console.anthropic.com, console.cloud.google.com, docs.github.com, ferry.dev, fetch.spec.whatwg.org, github.com, gitlab.com, id.atlassian.com, json-schema.org, mcp.context7.com, platform.openai.com, uploads.github.com

Source & flagged code

5 flagged

dist/cli/init/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/cli/init/index.ts

4import { execSync as execSync4 } from "node:child_process";

5import { existsSync as existsSync3, writeFileSync as writeFileSync4 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/init/index.jsView on unpkg · L3

6import { join as join4 } from "node:path";

8// src/cli/init/prompt.ts

9import { createInterface } from "node:readline/promises";

10import { stdin as input, stdout as output } from "node:process";

11var _rl = null;

12function rl() {

13 if (!_rl) {

14 _rl = createInterface({ input, output, terminal: false });

15 }

16 return _rl;

17}

18async function ask(question, defaultValue) {

19 const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

20 const answer = await rl().question(prompt);

21 const trimmed = answer.trim();

22 return trimmed || defaultValue || "";

23}

dist/cli/agent/run.jsView file

Lines 269-309javascript

269function byPrHeadSha(role, headSha) {

270 return `[ferry:${role}:${headSha.slice(0, 7)}]`;

271}

dist/cli/local/index.jsView file

Lines 355-395javascript

355 }

356 if (c.routing !== void 0) {

357 if (!c.routing || typeof c.routing !== "object" || Array.isArray

Source & flagged code

5 flagged · loading source

dist/cli/init/index.jsView file

3// src/cli/init/index.ts L4: import { execSync as execSync4 } from "node:child_process"; L5: import { existsSync as existsSync3, writeFileSync as writeFileSync4 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli/init/index.jsView on unpkg · L3

dist/cli/agent/run.jsView file

9124name: "bash", L9125: description: "Run a shell command (bash -c). Returns exit_code, stdout, stderr. Output capped at 64KB.", L9126: input_schema: {

High

Shell

Package source references shell execution.

dist/cli/agent/run.jsView on unpkg · L9124

6526const priorRefinerRuns = issue.comments.filter((c) => PRIOR_RUN_MARKER.test(c)); L6527: const runLink = `https://github.com/${process.env.GITHUB_REPO ?? "unknown"}/actions/runs/${process.env.GITHUB_RUN_ID ?? "0"}`; L6528: const idempotencyMarker = byEventId("refiner", eventId); ... L6538: // src/lib/agent-runtime/developer-prepare.ts L6539: import { execFileSync as execFileSync3 } from "node:child_process"; L6540:

Findings

5 High4 Medium5 Low

HighChild Processdist/cli/init/index.js

HighShelldist/cli/agent/run.js

HighSame File Env Network Executiondist/cli/agent/run.js

HighRemote Agent Bridgedist/cli/agent/run.js

HighCross File Remote Execution Contextdist/cli/local/index.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings