registry / @botbuddy/cli / 1.60.6
@botbuddy/cli@1.60.6
⚠ Under reviewBotBuddy — Swarm coordination CLI for multi-agent workflows
Static Scan Results
scanned 14d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/update-check.mjsView file
15import { mkdir, readFile, writeFile } from "node:fs/promises";
L16: import { spawn, spawnSync } from "node:child_process";
L17: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L15src/staging-pool/cli.mjsView file
18Trigger-reachable persistence chain: manifest.bin -> bin/botbuddy.mjs -> src/commands.mjs -> src/staging-pool/cli.mjs
L18:
L19: import { execFile } from "node:child_process";
L20: import * as nodeFs from "node:fs/promises";
...
L29: import { assessPoolHealth, healthReasons } from "./health.mjs";
L30: import { buildLaunchAgentPlist, createLaunchctl } from "./launchd.mjs";
L31: import { createEnvFilePasswordSource } from "./password-source.mjs";
...
L78:
L79: export function exitCodeFor(error) {
L80: if (error instanceof MintRefusedError || error?.code === "persona_not_allowed") return 2;
...
L190: owner,
L191: cwd = process.cwd(),
L192: home = homedir(),
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
src/staging-pool/cli.mjsView on unpkg · L18Findings
5 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/stack.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/cli.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.60.6.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.60.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.