registry / @castlemilk/omega / 0.6.9

@castlemilk/omega@0.6.9

Omega Harness CLI - installable via npx

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 727 KB of source, external domains: reactjs.org, www.w3.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 454-494javascript

454 title: opts.title,

455 description: opts.description,

456 complexity: opts.complexity,

457 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

458 })

459 });

460 console.log(JSON.stringify(task, null, 2));

461});

462taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

463 const query = opts.project ? `?projectId=${opts.project}` : "";

464 const tasks = await apiFetch(`/tasks${query}`);

465 console.log(JSON.stringify(tasks, null, 2));

466});

467taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

468 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

469 console.log(JSON.stringify(result, null, 2));

470});

471taskCmd.addCommand(taskFeedCmd);

472

473// ../../apps/cli/src/commands/ui.ts

474import { Command as Command4 } from "commander";

475import { spawn } from "child_process";

476import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L474

477import net from "net";

478import path2 from "path";

479import { fileURLToPath as fileURLToPath2 } from "url";

480import open from "open";

481import { render } from "ink";

482import React2 from "react";

483var __filename2 = fileURLToPath2(import.meta.url);

484var __dirname2 = path2.dirname(__filename2);

485var DEFAULT_PORT = 4e3;

486var MAX_PORT = 4010;

487var DEFAULT_GRPC_PORT = 50051;

488var MAX_GRPC_PORT = 50061;

489function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

490 return new Promise((resolve, reject) => {

491 if (preferred > max) {

492 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

493 return;

494 }

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {

559 console.warn("Could not auto-add project:"

•matchType = previous_version_dangerous_delta matchedPackage = @castlemilk/omega@0.6.8 matchedIdentity = npm:QGNhc3RsZW1pbGsvb21lZ2E:0.6.8 similarity = 0.947 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

474import { Command as Command4 } from "commander"; L475: import { spawn } from "child_process"; L476: import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L474

583stdio: "inherit", L584: shell: true, L585: env

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L583

573const grpcPort = await findAvailablePort(DEFAULT_GRPC_PORT, MAX_GRPC_PORT); L574: apiUrl = `http://localhost:${port.toString()}`; L575: process.env.HARNESS_API_URL = apiUrl; L576: const env = { ... L581: }; L582: server = startBundledServer(env) ?? spawn("pnpm", ["--filter", "@omega/server", "dev"], { L583: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L573

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

4 High2 Medium4 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 454-494javascript

454 title: opts.title,

455 description: opts.description,

456 complexity: opts.complexity,

457 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

458 })

459 });

460 console.log(JSON.stringify(task, null, 2));

461});

462taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

463 const query = opts.project ? `?projectId=${opts.project}` : "";

464 const tasks = await apiFetch(`/tasks${query}`);

465 console.log(JSON.stringify(tasks, null, 2));

466});

467taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

468 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

469 console.log(JSON.stringify(result, null, 2));

470});

471taskCmd.addCommand(taskFeedCmd);

472

473// ../../apps/cli/src/commands/ui.ts

474import { Command as Command4 } from "commander";

475import { spawn } from "child_process";

476import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L474

477import net from "net";

478import path2 from "path";

479import { fileURLToPath as fileURLToPath2 } from "url";

480import open from "open";

481import { render } from "ink";

482import React2 from "react";

483var __filename2 = fileURLToPath2(import.meta.url);

484var __dirname2 = path2.dirname(__filename2);

485var DEFAULT_PORT = 4e3;

486var MAX_PORT = 4010;

487var DEFAULT_GRPC_PORT = 50051;

488var MAX_GRPC_PORT = 50061;

489function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

490 return new Promise((resolve, reject) => {

491 if (preferred > max) {

492 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

493 return;

494 }

Lines 553-603javascript

553 headers: { "Content-Type": "application/json" },

554 body: JSON.stringify({ name, path: cwd })

555 });

556 if (createRes.ok) {

557 console.log(`Added project: ${name}`);

558 } else {

559 console.warn("Could not auto-add project:"

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg