registry / @casemark/linc / 0.79.7

@casemark/linc@0.79.7

Legal AI terminal agent powered by case.dev

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 269 file(s), 2.33 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.case.dev, api.github.com, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, distro.ibiblio.org, git-scm.com, github.com, gitlab.com, mariozechner.at, mistral.ai, pi.dev

Source & flagged code

7 flagged

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

Source & flagged code

7 flagged · loading source

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/utils/tools-manager.jsView file

186const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }"; L187: const powershellFailure = runExtractionCommand("powershell.exe", [ L188: "-NoLogo",

High

Shell

Package source references shell execution.

dist/utils/tools-manager.jsView on unpkg · L186

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

46}; L47: const require = createRequire(import.meta.url); L48: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L46

scripts/dark-linc.mjsView file

18if (!existsSync(command) || !existsSync(cliPath)) { L19: console.error("dark-linc requires a built package or repo dependencies. Run npm install and npm run build."); L20: process.exit(1); ... L22: L23: const result = spawnSync(command, [cliPath, ...process.argv.slice(2)], { L24: cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/dark-linc.mjsView on unpkg · L18

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Findings

3 High6 Medium6 Low

HighChild Processdist/core/exec.js

HighShelldist/utils/tools-manager.js

HighRuntime Package Installscripts/dark-linc.mjs

MediumDynamic Requiredist/core/extensions/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/utils/tools-manager.jsView file

Lines 166-206javascript

166}

167function getWindowsTarCommand() {

168 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

169 if (systemRoot) {

170 const systemTar = join(systemRoot, "System32", "tar.exe");

171 if (existsSync(systemTar)) {

172 return systemTar;

173 }

174 }

175 return "tar.exe";

176}

177function extractZipArchive(archivePath, extractDir, assetName) {

178 const failures = [];

179 if (platform() === "win32") {

180 // Windows ships bsdtar as tar.exe, which supports zip files. Prefer the

181 // System32 binary over Git Bash's GNU tar, which does not handle zip archives.

182 const tarFailure = runExtractionCommand(getWindowsTarCommand(), ["xf", archivePath, "-C", extractDir]);

183 if (!tarFailure)

184 return;

185 failures.push(tarFailure);

186 const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }";

187 const powershellFailure = runExtractionCommand("powershell.exe", [

188 "-NoLogo",

High

Shell

Package source references shell execution.

dist/utils/tools-manager.jsView on unpkg · L186

189 "-NoProfile",

190 "-NonInteractive",

191 "-ExecutionPolicy",

192 "Bypass",

193 "-Command",

194 script,

195 archivePath,

196 extractDir,

197 ]);

198 if (!powershellFailure)

199 return;

200 failures.push(powershellFailure);

201 }

202 else {

203 const unzipFailure = runExtractionCommand("unzip", ["-q", archivePath, "-d", extractDir]);

204 if (!unzipFailure)

205 return;

206 failures.push(unzipFailure);

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/extensions/loader.jsView file

Lines 26-66javascript

26import { execCommand } from "../exec.js";

27import { createSyntheticSourceInfo } from "../source-info.js";

28/** Modules available to extensions via virtualModules (for compiled Bun binary) */

29const VIRTUAL_MODULES = {

30 typebox: _bundledTypebox,

31 "typebox/compile": _bundledTypeboxCompile,

32 "typebox/value": _bundledTypeboxValue,

33 "@sinclair/typebox": _bundledTypebox,

34 "@sinclair/typebox/compile": _bundledTypeboxCompile,

35 "@sinclair/typebox/value": _bundledTypeboxValue,

36 "@earendil-works/pi-agent-core": _bundledPiAgentCore,

37 "@earendil-works/pi-tui": _bundledPiTui,

38 "@earendil-works/pi-ai": _bundledPiAi,

39 "@earendil-works/pi-ai/oauth": _bundledPiAiOauth,

40 "@earendil-works/pi-coding-agent": _bundledPiCodingAgent,

41 "@mariozechner/pi-agent-core": _bundledPiAgentCore,

42 "@mariozechner/pi-tui": _bundledPiTui,

43 "@mariozechner/pi-ai": _bundledPiAi,

44 "@mariozechner/pi-ai/oauth": _bundledPiAiOauth,

45 "@mariozechner/pi-coding-agent": _bundledPiCodingAgent,

46};

47const require = createRequire(import.meta.url);

48/**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L46

49 * Get aliases for jiti (used in Node.js/development mode).

50 * In Bun binary mode, virtualModules is used instead.

51 */

52let _aliases = null;

53function getAliases() {

54 if (_aliases)

55 return _aliases;

56 const __dirname = path.dirname(fileURLToPath(import.meta.url));

57 const packageIndex = path.resolve(__dirname, "../..", "index.js");

58 const typeboxEntry = require.resolve("typebox");

59 const typeboxCompileEntry = require.resolve("typebox/compile");

60 const typeboxValueEntry = require.resolve("typebox/value");

61 const packagesRoot = path.resolve(__dirname, "../../../../");

62 const resolveWorkspaceOrImport = (workspaceRelativePath, specifier) => {

63 const workspacePath = path.join(packagesRoot, workspaceRelativePath);

64 if (fs.existsSync(workspacePath)) {

65 return workspacePath;

66 }

scripts/dark-linc.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

3import { spawnSync } from "node:child_process";

4import { existsSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

9const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));

10const repoRoot = dirname(dirname(packageRoot));

11const tsxBin = join(repoRoot, "node_modules", ".bin", process.platform === "win32" ? "tsx.cmd" : "tsx");

12const distCliPath = join(packageRoot, "dist", "cli.js");

13const sourceCliPath = join(packageRoot, "src", "cli.ts");

15const command = existsSync(distCliPath) ? process.execPath : tsxBin;

16const cliPath = existsSync(distCliPath) ? distCliPath : sourceCliPath;

18if (!existsSync(command) || !existsSync(cliPath)) {

19 console.error("dark-linc requires a built package or repo dependencies. Run npm install and npm run build.");

20 process.exit(1);

21}

23const result = spawnSync(command, [cliPath, ...process.argv.slice(2)], {

24 cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/dark-linc.mjsView on unpkg · L18

25 env: {

26 ...process.env,

27 LINC_CODING_AGENT_DIR: process.env.DARK_LINC_AGENT_DIR ?? join(homedir(), ".dark-linc", "agent"),

28 LINC_PACKAGE_DIR: packageRoot,

29 PI_CONFIG_VARIANT: "dark-linc",

30 },

31 stdio: "inherit",

32});

34if (result.error) {

35 console.error(result.error.message);

36 process.exit(1);

37}