registry / @c4t4/heyamigo / 0.12.1

@c4t4/heyamigo@0.12.1

WhatsApp and Telegram AI bot powered by Claude, Codex, or Grok with long-term memory, browser control, and role-based access

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 490 KB of source, external domains: api.elevenlabs.io, api.telegram.org, docs.anthropic.com, github.com, nodejs.org, x.ai

Source & flagged code

3 flagged

dist/memory/importer.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync, readFileSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/memory/importer.jsView on unpkg · L1

3import { resolve } from 'path';

4import { config } from '../config.js';

5import { logger } from '../logger.js';

6import { logPrompt } from '../promptlog.js';

7import { memoryRoot } from './paths.js';

8import { ensureScaffold } from './store.js';

9function loadImportPrompt(source, target) {

10 const path = resolve(process.cwd(), config.memory.importInstructionsFile);

11 if (!existsSync(path)) {

12 throw new Error(`import instructions file missing: ${path}\nCreate one or set memory.importInstructionsFile in config.json`);

13 }

14 const raw = readFileSync(path, 'utf-8');

15 const today = new Date().toISOString().slice(0, 10);

16 return raw

17 .replaceAll('{{SOURCE}}', source)

18 .replaceAll('{{TARGET}}', target)

19 .replaceAll('{{DATE}}', today);

20}

21export async function runImport(sourcePath) {

dist/cli/service.jsView file

Lines 34-74javascript

34 return true;

35 }

36 catch {

37 return false;

38 }

39}

40function cleanPid() {

41 if (existsSync(PID_FILE

scripts/start-browser.shView file

•path = scripts/start-browser.sh kind = build_helper sizeBytes = 5583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-browser.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/memory/importer.jsView file

1import { spawn } from 'child_process'; L2: import { existsSync, readFileSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/memory/importer.jsView on unpkg · L1

dist/cli/service.jsView file

54const logFd = openSync(LOG_FILE, 'a'); L55: const child = spawn(process.execPath, [resolve(__distCli, 'supervisor.js')], { L56: detached: true, ... L64: console.log(`Started (PID: ${child.pid})`); L65: console.log(`Logs: npx @c4t4/heyamigo logs`); L66: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/service.jsView on unpkg · L54

scripts/start-browser.shView file

•path = scripts/start-browser.sh kind = build_helper sizeBytes = 5583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-browser.shView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/memory/importer.js

HighShell

HighRuntime Package Installdist/cli/service.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/start-browser.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/memory/importer.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import { existsSync, readFileSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/memory/importer.jsView on unpkg · L1

3import { resolve } from 'path';

4import { config } from '../config.js';

5import { logger } from '../logger.js';

6import { logPrompt } from '../promptlog.js';

7import { memoryRoot } from './paths.js';

8import { ensureScaffold } from './store.js';

9function loadImportPrompt(source, target) {

10 const path = resolve(process.cwd(), config.memory.importInstructionsFile);

11 if (!existsSync(path)) {

12 throw new Error(`import instructions file missing: ${path}\nCreate one or set memory.importInstructionsFile in config.json`);

13 }

14 const raw = readFileSync(path, 'utf-8');

15 const today = new Date().toISOString().slice(0, 10);

16 return raw

17 .replaceAll('{{SOURCE}}', source)

18 .replaceAll('{{TARGET}}', target)

19 .replaceAll('{{DATE}}', today);

20}

21export async function runImport(sourcePath) {

dist/cli/service.jsView file

Lines 34-74javascript

34 return true;

35 }

36 catch {

37 return false;

38 }

39}

40function cleanPid() {

41 if (existsSync(PID_FILE

scripts/start-browser.shView file

•path = scripts/start-browser.sh kind = build_helper sizeBytes = 5583 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/start-browser.shView on unpkg