registry / @castlemilk/omega / 0.6.23

@castlemilk/omega@0.6.23

Omega Harness CLI - installable via npx

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 425 KB of source, external domains: reactjs.org, www.w3.org

Source & flagged code

3 flagged

dist/server/dist/routes/benchmarks.jsView file

Lines 1-23javascript

1import { Router } from 'express';

2import fs from 'node:fs/promises';

3import path from 'node:path';

4import { spawn } from 'node:child_process';

5import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L3

6import { asyncHandler } from '../lib/async-handler.js';

7const root = process.cwd();

8const reportsDir = path.join(root, '.omega', 'reports');

9const statusFile = path.join(root, '.omega', 'bench-run-status.json');

10const runSchema = z.object({

11 suite: z.enum(['synthetic', 'deep-swe']).optional(),

12 nTasks: z.number().int().positive().optional(),

13 provider: z.string().optional(),

14 model: z.string().optional(),

15 timeout: z.number().int().positive().optional(),

16});

17async function readStatus() {

18 try {

19 const raw = await fs.readFile(statusFile, 'utf-8');

20 return JSON.parse(raw);

21 }

22 catch {

23 return { running: false };

dist/cli.jsView file

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {

Source & flagged code

3 flagged · loading source

dist/server/dist/routes/benchmarks.jsView file

3import path from 'node:path'; L4: import { spawn } from 'node:child_process'; L5: import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L3

dist/cli.jsView file

583stdio: "inherit", L584: shell: true, L585: env

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L583

573const grpcPort = await findAvailablePort(DEFAULT_GRPC_PORT, MAX_GRPC_PORT); L574: apiUrl = `http://localhost:${port.toString()}`; L575: process.env.HARNESS_API_URL = apiUrl; L576: const env = { ... L581: }; L582: server = startBundledServer(env) ?? spawn("pnpm", ["--filter", "@omega/server", "dev"], { L583: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L573

Findings

3 High3 Medium5 Low

HighChild Processdist/server/dist/routes/benchmarks.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/server/dist/routes/benchmarks.jsView file

Lines 1-23javascript

1import { Router } from 'express';

2import fs from 'node:fs/promises';

3import path from 'node:path';

4import { spawn } from 'node:child_process';

5import { z } from 'zod';

High

Child Process

Package source references child process execution.

dist/server/dist/routes/benchmarks.jsView on unpkg · L3

6import { asyncHandler } from '../lib/async-handler.js';

7const root = process.cwd();

8const reportsDir = path.join(root, '.omega', 'reports');

9const statusFile = path.join(root, '.omega', 'bench-run-status.json');

10const runSchema = z.object({

11 suite: z.enum(['synthetic', 'deep-swe']).optional(),

12 nTasks: z.number().int().positive().optional(),

13 provider: z.string().optional(),

14 model: z.string().optional(),

15 timeout: z.number().int().positive().optional(),

16});

17async function readStatus() {

18 try {

19 const raw = await fs.readFile(statusFile, 'utf-8');

20 return JSON.parse(raw);

21 }

22 catch {

23 return { running: false };

dist/cli.jsView file

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {