registry / @cluesmith/codev / 3.2.2

@cluesmith/codev@3.2.2

Codev CLI - AI-assisted software development framework

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 148 file(s), 2.52 MB of source, external domains: 127.0.0.1, aistudio.google.com, antigravity.google, bellard.org, cloud.codevos.ai, github.com, react.dev, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 65-87json

65 ],

66 "author": "Cluesmith",

67 "license": "Apache-2.0",

68 "repository": {

69 "type": "git",

70 "url": "https://github.com/cluesmith/codev"

71 },

72 "scripts": {

73 "clean": "rm -rf dist",

74 "build": "pnpm clean && tsc && pnpm build:dashboard && pnpm copy-skeleton",

75 "build:dashboard": "cd ../dashboard && pnpm build && rm -rf ../../packages/codev/dashboard-dist && cp -r dist ../../packages/codev/dashboard-dist",

76 "dev:dashboard": "cd ../dashboard && pnpm dev",

77 "copy-skeleton": "rm -rf skeleton && cp -r ../../codev-skeleton skeleton",

78 "dev": "tsx src/cli.ts",

79 "start": "node dist/cli.js",

80 "test": "vitest",

81 "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",

82 "test:e2e:watch": "vitest --config vitest.e2e.config.ts",

83 "test:e2e:playwright": "pnpm exec playwright test",

84 "test:e2e:cli": "pnpm build && vitest run --config vitest.cli.config.ts",

85 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 }

87}

dist/terminal/session-manager.jsView file

Lines 1-33javascript

1/**

2 * SessionManager: orchestrates shellper process lifecycle.

3 *

4 * Responsibilities:

5 * - Spawn shellper processes as detached children

6 * - Connect ShellperClient to each shellper

7 * - Kill sessions (SIGTERM → wait → SIGKILL)

8 * - Detect and clean up stale sockets

9 * - Auto-restart on exit (configurable per session)

10 * - Reconnect to existing shellpers after Tower restart

11 *

12 * Process start time validation prevents PID reuse reconnection.

dist/lib/forge.jsView file

Lines 1-27javascript

1/**

2 * Forge concept command dispatcher.

3 *

4 * Routes forge operations (issue fetch, PR list, etc.) through configurable

5 * external commands. Default commands wrap the `gh` CLI for GitHub repos.

6 * Projects override commands via the `forge` section in .codev/config.json.

7 *

8 * Concept commands are executed via shell (`sh -c`) to support pipes,

9 * redirects, and variable expansion in user-configured commands.

High

Shell

Package source references shell execution.

dist/lib/forge.jsView on unpkg · L7

dist/agent-farm/servers/tower-cron.jsView file

Lines 220-260javascript

220 timeout: options.timeout,

221 maxBuffer: 1024 * 1024, // 1MB

222 env: process.env,

223 }, (error, stdout, stderr) => {

224 if (error) {

225

dist/terminal/shellper-main.jsView file

Lines 2-42javascript

2/**

3 * Shellper main: standalone entry point spawned by Tower as a detached process.

4 *

5 * Usage:

6 * node shellper-main.js <json-config>

7 *

8 * Where json-config is a JSON string with:

9 * { command, args, cwd, env, cols, rows, socketPath }

10 *

11 * On startup:

12 * 1. Creates socket directory with 0700 permissions

13 * 2. Spawns PTY with requested command

dist/agent-farm/commands/tower.jsView file

Lines 182-222javascript

182 let command;

183 let args;

184 if (existsSync(tsScript)) {

185 // Dev mode: run with tsx

186 command = 'npx';

187 args = ['tsx', tsScript, String(port), '--log-file', LOG_FILE

scripts/forge/gitlab/pr-list.shView file

•path = scripts/forge/gitlab/pr-list.sh kind = build_helper sizeBytes = 771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/forge/gitlab/pr-list.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/terminal/session-manager.jsView file

13*/ L14: import { spawn as cpSpawn } from 'node:child_process'; L15: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/terminal/session-manager.jsView on unpkg · L13

dist/lib/forge.jsView file

7* L8: * Concept commands are executed via shell (`sh -c`) to support pipes, L9: * redirects, and variable expansion in user-configured commands.

High

Shell

Package source references shell execution.

dist/lib/forge.jsView on unpkg · L7

dist/agent-farm/servers/tower-cron.jsView file

240// eslint-disable-next-line no-new-func L241: const fn = new Function('output', 'return ' + condition); L242: return !!fn(output);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/agent-farm/servers/tower-cron.jsView on unpkg · L240

dist/terminal/shellper-main.jsView file

22// createRequire enables importing native/CJS modules (like node-pty) from ESM. L23: // The package uses "type": "module", so bare `require()` is not available. L24: const require = createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/terminal/shellper-main.jsView on unpkg · L22

dist/agent-farm/commands/tower.jsView file

202// Start tower server fully detached - stdio: 'ignore' ensures parent can exit L203: const serverProcess = spawn(command, args, { L204: cwd: process.cwd(), L205: env: process.env, L206: detached: true, ... L215: logToFile(`Spawned tower server with PID ${serverProcess.pid}`); L216: const dashboardUrl = `http://localhost:${port}`; L217: if (wait) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/agent-farm/commands/tower.jsView on unpkg · L202

scripts/forge/gitlab/pr-list.shView file

•path = scripts/forge/gitlab/pr-list.sh kind = build_helper sizeBytes = 771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/forge/gitlab/pr-list.shView on unpkg

Findings

4 High7 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/terminal/session-manager.js

HighShelldist/lib/forge.js

HighSame File Env Network Executiondist/agent-farm/commands/tower.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/terminal/shellper-main.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperscripts/forge/gitlab/pr-list.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/agent-farm/servers/tower-cron.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 65-87json

65 ],

66 "author": "Cluesmith",

67 "license": "Apache-2.0",

68 "repository": {

69 "type": "git",

70 "url": "https://github.com/cluesmith/codev"

71 },

72 "scripts": {

73 "clean": "rm -rf dist",

74 "build": "pnpm clean && tsc && pnpm build:dashboard && pnpm copy-skeleton",

75 "build:dashboard": "cd ../dashboard && pnpm build && rm -rf ../../packages/codev/dashboard-dist && cp -r dist ../../packages/codev/dashboard-dist",

76 "dev:dashboard": "cd ../dashboard && pnpm dev",

77 "copy-skeleton": "rm -rf skeleton && cp -r ../../codev-skeleton skeleton",

78 "dev": "tsx src/cli.ts",

79 "start": "node dist/cli.js",

80 "test": "vitest",

81 "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",

82 "test:e2e:watch": "vitest --config vitest.e2e.config.ts",

83 "test:e2e:playwright": "pnpm exec playwright test",

84 "test:e2e:cli": "pnpm build && vitest run --config vitest.cli.config.ts",

85 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 }

87}

dist/terminal/session-manager.jsView file

Lines 1-33javascript

1/**

2 * SessionManager: orchestrates shellper process lifecycle.

3 *

4 * Responsibilities:

5 * - Spawn shellper processes as detached children

6 * - Connect ShellperClient to each shellper

7 * - Kill sessions (SIGTERM → wait → SIGKILL)

8 * - Detect and clean up stale sockets

9 * - Auto-restart on exit (configurable per session)

10 * - Reconnect to existing shellpers after Tower restart

11 *

12 * Process start time validation prevents PID reuse reconnection.

dist/lib/forge.jsView file

Lines 1-27javascript

1/**

2 * Forge concept command dispatcher.

3 *

4 * Routes forge operations (issue fetch, PR list, etc.) through configurable

5 * external commands. Default commands wrap the `gh` CLI for GitHub repos.

6 * Projects override commands via the `forge` section in .codev/config.json.

7 *

8 * Concept commands are executed via shell (`sh -c`) to support pipes,

9 * redirects, and variable expansion in user-configured commands.

High

Shell

Package source references shell execution.

dist/lib/forge.jsView on unpkg · L7

dist/agent-farm/servers/tower-cron.jsView file

Lines 220-260javascript

220 timeout: options.timeout,

221 maxBuffer: 1024 * 1024, // 1MB

222 env: process.env,

223 }, (error, stdout, stderr) => {

224 if (error) {

225

dist/terminal/shellper-main.jsView file

Lines 2-42javascript

2/**

3 * Shellper main: standalone entry point spawned by Tower as a detached process.

4 *

5 * Usage:

6 * node shellper-main.js <json-config>

7 *

8 * Where json-config is a JSON string with:

9 * { command, args, cwd, env, cols, rows, socketPath }

10 *

11 * On startup:

12 * 1. Creates socket directory with 0700 permissions

13 * 2. Spawns PTY with requested command

dist/agent-farm/commands/tower.jsView file

Lines 182-222javascript

182 let command;

183 let args;

184 if (existsSync(tsScript)) {

185 // Dev mode: run with tsx

186 command = 'npx';

187 args = ['tsx', tsScript, String(port), '--log-file', LOG_FILE

scripts/forge/gitlab/pr-list.shView file

•path = scripts/forge/gitlab/pr-list.sh kind = build_helper sizeBytes = 771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/forge/gitlab/pr-list.shView on unpkg