registry / @crbonfree/cli / 0.1.9
@crbonfree/cli@0.1.9
⚠ Under reviewSee the carbon footprint of your AI coding agents, and give them a unified brain across every tool.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/mechanisms/readCacheCli.jsView file
3// src/mechanisms/readCacheCli.ts
L4: import { spawnSync } from "child_process";
L5:
High
Child Process
Package source references child process execution.
dist/mechanisms/readCacheCli.jsView on unpkg · L3185const result = spawnSync(command, {
L186: shell: true,
L187: encoding: "utf-8",
High
3// src/mechanisms/readCacheCli.ts
L4: import { spawnSync } from "child_process";
L5:
...
L25: function configDir() {
L26: return process.env.CRBON_HOME ?? join2(homedir(), ".crbon");
L27: }
...
L34: try {
L35: return JSON.parse(readFileSync2(p, "utf-8"));
L36: } catch {
...
L39: }
L40: var DEFAULT_BACKEND_SERVER_URL = process.env.CRBON_BACKEND_URL ?? "https://api.crbonfree.com";
L41:
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/mechanisms/readCacheCli.jsView on unpkg · L3Findings
7 High4 Medium5 Low
HighChild Processdist/mechanisms/readCacheCli.js
HighShelldist/mechanisms/readCacheCli.js
HighSame File Env Network Executiondist/proxyServer.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighSemantic Analysis Limiteddist/hooks/installer.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/hooks/installer.js
MediumDynamic Requiredist/update.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
LowScripts Present
LowWeak Cryptodist/mechanisms/readCacheCli.js
Affected versions and remediation
This report applies to @crbonfree/cli@0.1.9.
See all versions of @crbonfree/cli for other recorded verdicts.
- Review the evidence and your use of @crbonfree/cli@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.