registry / @codeledger/cli / 0.10.48

@codeledger/cli@0.10.48

Official ContextECF CodeLedger CLI wrapper. Installs the hardened binary from GitHub Releases; zero engine code ships in this package.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 16.5 KB of source, external domains: github.com

Source & flagged code

2 flagged

package.jsonView file

Lines 21-46json

21 "node": ">=18"

22 },

23 "repository": {

24 "type": "git",

25 "url": "github:codeledgerECF/codeledger"

26 },

27 "license": "SEE LICENSE IN LICENSE",

28 "keywords": [

29 "codeledger",

30 "contextecf",

31 "context",

32 "ai",

33 "claude",

34 "cursor",

35 "copilot"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "scripts": {

41 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "test": "vitest run",

43 "build": "echo 'no build — ships as-is'",

44 "typecheck": "echo 'no ts — ships as-is'"

45 }

46}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code