registry / @c4a/context-cli / 0.7.1

@c4a/context-cli@0.7.1

⚠ Under review

Local runtime and Agent integration for traceable knowledge production

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 261 KB of source

Oversized source lightweight scan

cli.js5.65 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsShellHighEntropyStrings

Source & flagged code

12 flagged

package.jsonView file

Lines 28-51json

28 "commander": "^11.0.0",

29 "fast-xml-parser": "^5.10.1",

30 "handlebars": "^4.7.8",

31 "ink": "^5.0.0",

32 "jiti": "^2.7.0",

33 "mdast-util-to-string": "^4.0.0",

34 "react": "^18.3.1",

35 "remark-gfm": "^4.0.1",

36 "remark-mdx": "^3.1.1",

37 "remark-parse": "^11.0.0",

38 "remark-stringify": "^11.0.0",

39 "sharp": "^0.35.3",

40 "typescript": "^5.5.4",

41 "unified": "^11.0.5",

42 "web-tree-sitter": "^0.20.8",

43 "yaml": "^2.5.1",

44 "zod": "^3.23.8"

45 },

46 "main": "./cli.js",

47 "scripts": {

48 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 }

50}

scripts/postinstall.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * Best-effort global agent plugin refresh after a global context-cli install.

4 * Local project dependencies and CI installs must not mutate user-level agent

5 * configuration. Link development performs the same refresh in cliLink.ts.

6 */

8import { spawnSync } from "node:child_process";

9import { existsSync, realpathSync }

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @c4a/context-cli@0.6.0-beta.8 matchedIdentity = npm:QGM0YS9jb250ZXh0LWNsaQ:0.6.0-beta.8 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1100args.unshift(executableFile); L1101: args = incrementNodeInspectorPort(process2.execArgv).concat(args); L1102: proc = childProcess.spawn(process2.argv[0], args, { stdio: "inherit" });

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L1100

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli.js: import { mkdir as mkdir4, rename as rename2, rm, writeFile as writeFile3 } from "node:fs/promises"; async function atomicWriteFile(path3, content3) { await writeFile3(tmpPath, content3, "utf8"); await atomicWriteFile(paths.state, `${JSON.stringify(nextState, null, 2)} await atomicWriteFile(packagePath, `${JSON.stringify(parsed, null, 2)} await atomicWriteFile(outputPath2, `${JSON.stringify(replay, null, 2)} SENSITIVE_OPTION = /^(--(?:auth|authorization|password|secret|token|otp|cookie|api-key))(?:=|$)/iu; import { mkdir as mkdir7, readFile as readFile11, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

@c4a/context-cli@0.7.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code