registry / @castlemilk/omega / 0.6.16

@castlemilk/omega@0.6.16

Omega Harness CLI - installable via npx

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 1.77 MB of source, external domains: example.com, reactjs.org, www.w3.org

Source & flagged code

4 flagged

dist/server/dist/routes/benchmarks.jsView file

Lines 1-24javascript

1import { Router } from 'express';

2import fs from 'node:fs/promises';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { spawn } from 'node:child_process';

6import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L4

7import { asyncHandler } from '../lib/async-handler.js';

8const __filename = fileURLToPath(import.meta.url);

9const root = path.resolve(__filename, '..', '..', '..', '..');

10const reportsDir = path.join(root, '.omega', 'reports');

11const statusFile = path.join(root, '.omega', 'bench-run-status.json');

12const runSchema = z.object({

13 suite: z.enum(['synthetic', 'deep-swe']).optional(),

14 nTasks: z.number().int().positive().optional(),

15 provider: z.string().optional(),

16 model: z.string().optional(),

17 timeout: z.number().int().positive().optional(),

18});

19async function readStatus() {

20 try {

21 const raw = await fs.readFile(statusFile, 'utf-8');

22 return JSON.parse(raw);

23 }

24 catch {

dist/cli.jsView file

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {

Source & flagged code

4 flagged · loading source

dist/server/dist/routes/benchmarks.jsView file

4import { fileURLToPath } from 'node:url'; L5: import { spawn } from 'node:child_process'; L6: import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L4

dist/cli.jsView file

583stdio: "inherit", L584: shell: true, L585: env

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L583

573const grpcPort = await findAvailablePort(DEFAULT_GRPC_PORT, MAX_GRPC_PORT); L574: apiUrl = `http://localhost:${port.toString()}`; L575: process.env.HARNESS_API_URL = apiUrl; L576: const env = { ... L581: }; L582: server = startBundledServer(env) ?? spawn("pnpm", ["--filter", "@omega/server", "dev"], { L583: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L573

•matchType = previous_version_dangerous_delta matchedPackage = @castlemilk/omega@0.6.12 matchedIdentity = npm:QGNhc3RsZW1pbGsvb21lZ2E:0.6.12 similarity = 0.848 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

4 High3 Medium5 Low

HighChild Processdist/server/dist/routes/benchmarks.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/server/dist/routes/benchmarks.jsView file

Lines 1-24javascript

1import { Router } from 'express';

2import fs from 'node:fs/promises';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { spawn } from 'node:child_process';

6import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L4

7import { asyncHandler } from '../lib/async-handler.js';

8const __filename = fileURLToPath(import.meta.url);

9const root = path.resolve(__filename, '..', '..', '..', '..');

10const reportsDir = path.join(root, '.omega', 'reports');

11const statusFile = path.join(root, '.omega', 'bench-run-status.json');

12const runSchema = z.object({

13 suite: z.enum(['synthetic', 'deep-swe']).optional(),

14 nTasks: z.number().int().positive().optional(),

15 provider: z.string().optional(),

16 model: z.string().optional(),

17 timeout: z.number().int().positive().optional(),

18});

19async function readStatus() {

20 try {

21 const raw = await fs.readFile(statusFile, 'utf-8');

22 return JSON.parse(raw);

23 }

24 catch {

dist/cli.jsView file

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {