registry / @cliangdev/conductor / 0.5.0

@cliangdev/conductor@0.5.0

Agentic software development platform — AI-driven PRD, implementation, and beyond

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 38 file(s), 170 KB of source, external domains: conductor-backend-199707291514.us-central1.run.app, conductor-frontend-199707291514.us-central1.run.app, my-backend.example.com

Source & flagged code

3 flagged

package.jsonView file

Lines 9-47json

9 },

10 "engines": {

11 "node": ">=22.14.0",

12 "npm": ">=11.5.1"

13 },

14 "packageManager": "npm@11.17.0",

15 "type": "module",

16 "bin": {

17 "conductor": "./dist/index.js"

18 },

19 "main": "./dist/index.js",

20 "files": [

21 "dist/",

22 "assets/",

23 "scripts/"

24 ],

25 "scripts": {

26 "build": "tsc",

27 "dev": "ts-node src/index.ts",

28 "test": "vitest run",

29 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "preuninstall": "node scripts/preuninstall.js"

31 },

32 "dependencies": {

33 "@modelcontextprotocol/sdk": "^1.0.0",

34 "chalk": "^5.3.0",

35 "chokidar": "^5.0.0",

36 "commander": "^15.0.0",

37 "open": "^11.0.0",

38 "ora": "^9.4.0"

39 },

40 "devDependencies": {

41 "@types/node": "^26.0.0",

42 "ts-node": "^10.9.0",

43 "typescript": "^5.4.0",

44 "vitest": "^4.1.5"

45 }

46}

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { Command } from 'commander';

4const require = createRequire(import.meta.url);

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code