registry / @chozzz/vargos / 3.2.8

@chozzz/vargos@3.2.8

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 97 file(s), 326 KB of source, external domains: api.anthropic.com, api.deepseek.com, api.groq.com, api.openai.com, api.telegram.org, generativelanguage.googleapis.com, openrouter.ai

Source & flagged code

5 flagged

package.jsonView file

Lines 77-99json

77 "*.ts": [

78 "eslint --fix"

79 ]

80 },

81 "engines": {

82 "node": ">=22.19.0"

83 },

84 "scripts": {

85 "start": "tsx index.ts",

86 "seed": "tsx scripts/seed.ts",

87 "migrate": "tsx scripts/migrate.ts",

88 "cli": "tsx cli.ts",

89 "verify": "tsx scripts/verify-core.ts",

90 "chat": "tsx scripts/seed.ts && PI_CODING_AGENT_DIR=\"${VARGOS_DATA_DIR:-$HOME/.vargos}/agent\" pi --session-dir \"${VARGOS_DATA_DIR:-$HOME/.vargos}/sessions/cli\"",

91 "build": "rm -rf dist && tsc && cp -r .templates dist/.templates",

92 "test": "vitest",

93 "test:run": "vitest run",

94 "lint": "eslint --no-error-on-unmatched-pattern 'core/**/*.ts' 'services/**/*.ts' 'edge/**/*.ts' 'lib/**/*.ts' '.migrations/**/*.ts' 'scripts/**/*.ts' 'index.ts' 'boot.ts' 'cli.ts' 'cli/**/*.ts' 'vitest.config.ts' && tsc --noEmit",

95 "typecheck": "tsc --noEmit",

96 "precommit": "pnpm exec lint-staged && pnpm run typecheck && pnpm run test:run",

97 "postinstall": "pnpm rebuild better-sqlite3"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L97

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L97

98 }

99}

dist/core/loader.jsView file

Lines 6-46javascript

6 * Known leak (see docs/architecture.md § Hot reload): each reload imports a fresh

7 * module URL (`?v=<ts>`), and ESM cannot evict the prior

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView file

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = payload_in_excluded_dir sizeBytes = 3223 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

•path = dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh kind = build_helper sizeBytes = 3223 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = pnpm rebuild better-sqlite3

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = pnpm rebuild better-sqlite3

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/loader.jsView file

26const url = pathToFileURL(spec.modulePath).href + '?v=' + Date.now(); L27: const mod = await import(url); L28: if (typeof mod.createService !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/loader.jsView on unpkg · L26

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/.templates/agent/skills/token-capture/scripts/capture-bearer-token.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings