registry / @codemap-ai/cli / 3.2.0

@codemap-ai/cli@3.2.0

CodeMap — AI-powered coding agent CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 1019 KB of source, external domains: api.anthropic.com, api.codemap.codes, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, cli.github.com, generativelanguage.googleapis.com, github.com, openrouter.ai, www.apache.org

Oversized source lightweight scan

dist/chunk-TCVRDYVR.js9.76 MB file, sampled 256 KB

FilesystemNetworkChildProcessShellDynamicRequireHighEntropyStringsUrlStringswww.apache.org

Source & flagged code

6 flagged

dist/chunk-3S5BVCJ3.jsView file

Lines 1-30javascript

1import{createRequire as __cmr}from"node:module";import{fileURLToPath as __f2p}from"node:url";import{dirname as __dn}from"node:path";var require=__cmr(import.meta.url);var __filename=__f2p(import.meta.url);var __dirname=__dn(__filename);

2import {

3 findMonorepoRoot

4} from "./chunk-IF4D32CF.js";

6// ../core/src/lib/workspace-project.ts

7import path2 from "path";

8import { access, mkdir, readFile, writeFile } from "fs/promises";

10// ../core/src/lib/workspace-git.ts

11import { execFile } from "child_process";

12import path from "path";

High

Child Process

Package source references child process execution.

dist/chunk-3S5BVCJ3.jsView on unpkg · L10

13import { promisify } from "util";

14var execFileAsync = promisify(execFile);

15function normalizeRemoteUrl(url) {

16 const sshMatch = /^git@([^:]+):(.+?)(?:\.git)?$/i.exec(url);

17 if (sshMatch) {

18 return `https://${sshMatch[1]}/${sshMatch[2].replace(/\.git$/i, "")}`;

19 }

20 const sshProtoMatch = /^ssh:\/\/git@([^/]+)\/(.+?)(?:\.git)?$/i.exec(url);

21 if (sshProtoMatch) {

22 return `https://${sshProtoMatch[1]}/${sshProtoMatch[2].replace(/\.git$/i, "")}`;

23 }

24 return url;

25}

26async function runGitCommand(cwd, args) {

27 const { stdout } = await execFileAsync("git", args, {

28 cwd,

29 env: {

30 ...process.env,

dist/chunk-QOVUOTG6.jsView file

Lines 1998-2038javascript

1998 await ctx.reinitHarness?.();

1999 ctx.setBusy(false);

2000 ctx.setMessages((prev) => [

2001 ...prev,

2002 { role: "system", content: `Harness reinitialized without "${name}".` }

2003 ]);

dist/chunk-QIZGRMM4.jsView file

Lines 1866-1906javascript

1866import { join as join3 } from "path";

1867import { homedir as homedir4 } from "os";

1868

1869// ../runtime-node/src/tools/custom/load-custom-tools.ts

1870import { readdir } from "fs/promises";

1871import { homedir } from "os"

dist/app-ST3DU6U2.jsView file

Lines 1-21javascript

dist/chunk-4VMO47HE.jsView file

Lines 25-65javascript

25 headers,

26 signal: AbortSignal.timeout(1e4)

27 });

28 if (!response.ok) {

29 return [];

30 }

31 const data = await response.json

dist/chunk-TCVRDYVR.jsView file

•path = dist/chunk-TCVRDYVR.js kind = oversized_source_file sizeBytes = 10234850 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-TCVRDYVR.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-3S5BVCJ3.jsView file

10// ../core/src/lib/workspace-git.ts L11: import { execFile } from "child_process"; L12: import path from "path";

High

Child Process

Package source references child process execution.

dist/chunk-3S5BVCJ3.jsView on unpkg · L10

dist/chunk-QOVUOTG6.jsView file

2018import { promisify } from "util"; L2019: var execAsync = promisify(exec); L2020: async function runShell(command) {

High

Shell

Package source references shell execution.

dist/chunk-QOVUOTG6.jsView on unpkg · L2018

dist/chunk-QIZGRMM4.jsView file

1886try { L1887: const mod = await import(filePath); L1888: const tool2 = mod?.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QIZGRMM4.jsView on unpkg · L1886

dist/app-ST3DU6U2.jsView file

1Cross-file remote execution chain: dist/app-ST3DU6U2.js spawns dist/chunk-IF4D32CF.js; helper contains network access plus dynamic code execution. L1: import{createRequire as __cmr}from"node:module";import{fileURLToPath as __f2p}from"node:url";import{dirname as __dn}from"node:path";var require=__cmr(import.meta.url);var __filenam... L2: import { ... L79: try { L80: const parsed = JSON.parse(content); L81: if (parsed && typeof parsed === "object") { ... L206: return text.replace( L207: /!\[([^\]]*)\]$data:image\/[^;]+;base64,[a-zA-Z0-9+/=\s]+$/g, L208: (_match, alt) => `[image${alt ? `: ${alt}` : ""}]` ... L479: import { readFile, stat } from "fs/promises"; L480: import { execFile } from "child_process"; L481: import { fileURLToPath } from "url"; ... L500: async function readClipboardImage() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/app-ST3DU6U2.jsView on unpkg · L1

dist/chunk-4VMO47HE.jsView file

45async function install9Router() { L46: execSync("npm install -g 9router", { stdio: "inherit" }); L47: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-4VMO47HE.jsView on unpkg · L45

dist/chunk-TCVRDYVR.jsView file

•path = dist/chunk-TCVRDYVR.js kind = oversized_source_file sizeBytes = 10234850 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-TCVRDYVR.jsView on unpkg

Findings

5 High4 Medium5 Low

HighChild Processdist/chunk-3S5BVCJ3.js

HighShelldist/chunk-QOVUOTG6.js

HighCross File Remote Execution Contextdist/app-ST3DU6U2.js

HighRuntime Package Installdist/chunk-4VMO47HE.js

HighOversized Source Filedist/chunk-TCVRDYVR.js

MediumDynamic Requiredist/chunk-QIZGRMM4.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/chunk-3S5BVCJ3.jsView file

Lines 1-30javascript

2import {

3 findMonorepoRoot

4} from "./chunk-IF4D32CF.js";

6// ../core/src/lib/workspace-project.ts

7import path2 from "path";

8import { access, mkdir, readFile, writeFile } from "fs/promises";

10// ../core/src/lib/workspace-git.ts

11import { execFile } from "child_process";

12import path from "path";

High

Child Process

Package source references child process execution.

dist/chunk-3S5BVCJ3.jsView on unpkg · L10

13import { promisify } from "util";

14var execFileAsync = promisify(execFile);

15function normalizeRemoteUrl(url) {

16 const sshMatch = /^git@([^:]+):(.+?)(?:\.git)?$/i.exec(url);

17 if (sshMatch) {

18 return `https://${sshMatch[1]}/${sshMatch[2].replace(/\.git$/i, "")}`;

19 }

20 const sshProtoMatch = /^ssh:\/\/git@([^/]+)\/(.+?)(?:\.git)?$/i.exec(url);

21 if (sshProtoMatch) {

22 return `https://${sshProtoMatch[1]}/${sshProtoMatch[2].replace(/\.git$/i, "")}`;

23 }

24 return url;

25}

26async function runGitCommand(cwd, args) {

27 const { stdout } = await execFileAsync("git", args, {

28 cwd,

29 env: {

30 ...process.env,

dist/chunk-QOVUOTG6.jsView file

Lines 1998-2038javascript

1998 await ctx.reinitHarness?.();

1999 ctx.setBusy(false);

2000 ctx.setMessages((prev) => [

2001 ...prev,

2002 { role: "system", content: `Harness reinitialized without "${name}".` }

2003 ]);

dist/chunk-QIZGRMM4.jsView file

Lines 1866-1906javascript

1866import { join as join3 } from "path";

1867import { homedir as homedir4 } from "os";

1868

1869// ../runtime-node/src/tools/custom/load-custom-tools.ts

1870import { readdir } from "fs/promises";

1871import { homedir } from "os"

dist/app-ST3DU6U2.jsView file

Lines 1-21javascript

dist/chunk-4VMO47HE.jsView file

Lines 25-65javascript

25 headers,

26 signal: AbortSignal.timeout(1e4)

27 });

28 if (!response.ok) {

29 return [];

30 }

31 const data = await response.json

dist/chunk-TCVRDYVR.jsView file

•path = dist/chunk-TCVRDYVR.js kind = oversized_source_file sizeBytes = 10234850 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-TCVRDYVR.jsView on unpkg