registry / @byteask/cli / 0.1.1

@byteask/cli@0.1.1

ByteAsk - AI coding agent CLI for your terminal. Run `npx @byteask/cli` or `npm i -g @byteask/cli`.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.27 KB of source, external domains: code.byteask.ai

Source & flagged code

1 flagged

bin/byteask.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

3// ByteAsk npm launcher (thin bootstrapper).

4//

5// On first run it installs the native ByteAsk engine + wrapper into a shared

6// runtime dir (~/.byteask/runtime) via the same installer the curl|sh path uses,

7// then execs the wrapper. All the real logic (login, onboarding, update check,

8// /login|/logout loop) lives in that native wrapper — this file only bootstraps.

9// The runtime dir is shared with the pip package, so the engine downloads once.

11const { spawnSync } = require("child_process");

12const { existsSync, mkdirSync } = require("fs");

13const path = require("path");

14const os = require("os");

16const BUNDLE = (process.env.BYTEASK_BUNDLE_URL || "https://code.byteask.ai").replace(/\/+$/, "");

17const HOME = process.env.BYTEASK_HOME || path.join(os.homedir(), ".byteask");

18const VENDOR = path.join(HOME, "runtime");

19const isWin = process.platform === "win32";

20const wrapper = path.join(VENDOR, isWin ? "byteask.ps1" : "byteask");

21const engine = path.join(VENDOR, isWin ? "byteask-engine.exe" : "byteask-engine");

23function run(cmd, args) {

24 return spawnSync(cmd, args, { stdio: "inherit" });

25}

27function ensureInstalled() {

28 if (existsSync(engine) && existsSync(wrapper)) return;

29 mkdirSync(VENDOR, { recursive: true });

30 process.stderr.write("[byteask] first run: fetching the ByteAsk engine (one time)...\n");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/byteask.jsView on unpkg · L10

Source & flagged code

1 flagged · loading source

bin/byteask.jsView file

10L11: const { spawnSync } = require("child_process"); L12: const { existsSync, mkdirSync } = require("fs"); ... L15: L16: const BUNDLE = (process.env.BYTEASK_BUNDLE_URL || "https://code.byteask.ai").replace(/\/+$/, ""); L17: const HOME = process.env.BYTEASK_HOME || path.join(os.homedir(), ".byteask"); L18: const VENDOR = path.join(HOME, "runtime"); L19: const isWin = process.platform === "win32"; L20: const wrapper = path.join(VENDOR, isWin ? "byteask.ps1" : "byteask"); ... L29: mkdirSync(VENDOR, { recursive: true }); L30: process.stderr.write("[byteask] first run: fetching the ByteAsk engine (one time)...\n"); L31: let r;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/byteask.jsView on unpkg · L10

Findings

1 High1 Medium2 Low

HighSandbox Evasion Gated Capabilitybin/byteask.js

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

bin/byteask.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

3// ByteAsk npm launcher (thin bootstrapper).

4//

5// On first run it installs the native ByteAsk engine + wrapper into a shared

6// runtime dir (~/.byteask/runtime) via the same installer the curl|sh path uses,

7// then execs the wrapper. All the real logic (login, onboarding, update check,

8// /login|/logout loop) lives in that native wrapper — this file only bootstraps.

9// The runtime dir is shared with the pip package, so the engine downloads once.

11const { spawnSync } = require("child_process");

12const { existsSync, mkdirSync } = require("fs");

13const path = require("path");

14const os = require("os");

16const BUNDLE = (process.env.BYTEASK_BUNDLE_URL || "https://code.byteask.ai").replace(/\/+$/, "");

17const HOME = process.env.BYTEASK_HOME || path.join(os.homedir(), ".byteask");

18const VENDOR = path.join(HOME, "runtime");

19const isWin = process.platform === "win32";

20const wrapper = path.join(VENDOR, isWin ? "byteask.ps1" : "byteask");

21const engine = path.join(VENDOR, isWin ? "byteask-engine.exe" : "byteask-engine");

23function run(cmd, args) {

24 return spawnSync(cmd, args, { stdio: "inherit" });

25}

27function ensureInstalled() {

28 if (existsSync(engine) && existsSync(wrapper)) return;

29 mkdirSync(VENDOR, { recursive: true });

30 process.stderr.write("[byteask] first run: fetching the ByteAsk engine (one time)...\n");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/byteask.jsView on unpkg · L10