registry / @deepseekcode/cli / 1.0.40

@deepseekcode/cli@1.0.40

⚠ Under review

DeepSeekCode — local-first AI coding agent for your terminal: one local runtime with a TUI, a web UI and an API, a permission/approval layer, read-only plan mode, and any OpenAI-compatible model.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 398 file(s), 17.2 MB of source, external domains: 127.0.0.1, api.example.com, cdn.jsdelivr.net, chevrotain.io, en.wikipedia.org, example.com, github.com, langium.org, mcp.example.com, prosemirror.net, pypi.org, pypi.tuna.tsinghua.edu.cn, react.dev, tailscale.com, www.eclipse.org, www.python.org, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 "coding-agent",

10 "ai-agent",

11 "ai-cli",

12 "terminal",

13 "tui",

14 "local-first",

15 "openai-compatible",

16 "mcp",

17 "plan-mode",

18 "code-review",

19 "developer-tools",

20 "typescript"

21 ],

22 "type": "module",

23 "license": "SEE LICENSE IN LICENSE.md",

24 "bin": {

25 "dscode": "bin/dscode.exe",

26 "deepseekcode": "bin/dscode.exe"

27 },

28 "scripts": {

29 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 },

31 "engines": {

32 "node": ">=18"

33 },

34 "dependencies": {

35 "playwright": "1.62.1",

36 "xterm": "5.3.0"

37 },

38 "optionalDependencies": {

39 "@deepseekcode/cli-darwin-arm64": "1.0.40",

40 "@deepseekcode/cli-darwin-x64": "1.0.40",

41 "@deepseekcode/cli-linux-x64": "1.0.40",

42 "@deepseekcode/cli-linux-arm64": "1.0.40",

43 "@deepseekcode/cli-linux-x64-musl": "1.0.40",

44 "@deepseekcode/cli-linux-arm64-musl": "1.0.40",

45 "@deepseekcode/cli-win32-x64": "1.0.40",

46 "@deepseekcode/cli-win32-arm64": "1.0.40"

47 },

48 "files": [

49 "bin/",

bin/dscode.exeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/dscode.exeView on unpkg

•path = bin/dscode.exe kind = native_binary sizeBytes = 502 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dscode.exeView on unpkg

bin/tts/tts_server.pyView file

•path = bin/tts/tts_server.py kind = build_helper sizeBytes = 16398 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/tts/tts_server.pyView on unpkg

web/dist/assets/stateDiagram-v2-TBUQTH76-FGgFDGUU.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deepseekcode/cli@1.0.37 matchedIdentity = npm:QGRlZXBzZWVrY29kZS9jbGk:1.0.37 similarity = 0.550 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web/dist/assets/stateDiagram-v2-TBUQTH76-FGgFDGUU.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/dscode.exeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/dscode.exeView on unpkg

•path = bin/dscode.exe kind = native_binary sizeBytes = 502 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/dscode.exeView on unpkg

Findings

3 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedbin/dscode.exe

HighPrevious Version Dangerous Deltaweb/dist/assets/stateDiagram-v2-TBUQTH76-FGgFDGUU.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/dscode.exe

MediumShips Build Helperbin/tts/tts_server.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @deepseekcode/cli@1.0.40.

See all versions of @deepseekcode/cli for other recorded verdicts.

Review the evidence and your use of @deepseekcode/cli@1.0.40 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 00:02:51.523Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.