registry / @devflow-tools/devflow / 0.18.36

@devflow-tools/devflow@0.18.36

⚠ Under review

Installable DevFlow distribution containing the CLI, runtime hooks, and Claude plugin.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 2.80 MB of source, external domains: 127.0.0.1, github.com, nextjs.org, react.dev, reactflow.dev, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 1-38json

2 "name": "@devflow-tools/devflow",

3 "version": "0.18.36",

4 "type": "module",

5 "description": "Installable DevFlow distribution containing the CLI, runtime hooks, and Claude plugin.",

6 "bin": {

7 "devflow": "./bin/devflow"

8 },

9 "scripts": {

10 "build": "tsup",

11 "bundle:dashboard": "test -f ../../apps/dashboard/out/index.html || npm run build -w apps/dashboard; rm -rf dist/dashboard && mkdir -p dist/dashboard && cp -R ../../apps/dashboard/out/. dist/dashboard/",

12 "audit-session-data": "node --import tsx scripts/audit-session-data.ts",

13 "maintain:semantic-reliability": "node --import tsx scripts/semantic-reliability-maintenance.ts",

14 "build:watch": "tsup --watch",

15 "clean": "rm -rf dist",

16 "postbuild": "cp ../../apps/server/public/fallback.html dist/fallback.html && node --import tsx scripts/bundle-plugin.ts",

17 "prepack": "npm run build && npm run bundle:dashboard",

18 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

21 "@colbymchenry/codegraph": "^1.1.1",

22 "@devflow-tools/adapters": "0.18.36",

23 "@devflow-tools/benchmark": "0.18.36",

24 "@devflow-tools/context-engine": "0.18.36",

25 "@devflow-tools/database": "0.18.36",

26 "@devflow-tools/delivery-line": "0.18.36",

27 "@devflow-tools/knowledge-engine": "0.18.36",

28 "@devflow-tools/mcp-server": "0.18.36",

29 "@devflow-tools/memory-engine": "0.18.36",

30 "@devflow-tools/retrieval-engine": "0.18.36",

31 "@devflow-tools/sdk": "0.18.36",

32 "@devflow-tools/semantic-engine": "0.18.36",

33 "@devflow-tools/server": "0.18.36",

34 "@devflow-tools/task-runtime": "0.18.36",

35 "@devflow-tools/telemetry": "0.18.36",

36 "@devflow-tools/workflow-engine": "0.18.36",

37 "@inquirer/prompts": "^7.10.1",

38 "@modelcontextprotocol/sdk": "^1.30.0",

dist/plugin/dist/hooks/hook-daemon.jsView file

Lines 1-21javascript

1import {createServer,createConnection}from'net';import {createHash,randomUUID as randomUUID$1,generateKeyPairSync,sign}from'node:crypto';import {execFileSync,spawn}from'node:child_process';import {dirname,join as join$1}from'path';import {mkdirSync,lstatSync,openSync,writeFileSync,fstatSync,closeSync,readFileSync,unlinkSync,existsSync

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import {createRequire as createRequire$1,isBuiltin}from'node:module';import {join as join$1,resolve,basename,dirname as dirname$1,relative,sep,isAbsolute,extname}from'node:path';import {createRuntimeManager,resolveStableProjectIdentity,loadPlugins,getPluginInstallRoot,resolveProjectCapabilityProfile,stableRuntimeHash,readPersistedClaudeHookNode,resolveClaudeHookRuntime,verifyClaudeHookNativeRuntime,redactMcpInventory,readMcpInventory,checkMcpHealth,readCachedMcpHealth,DOCTOR_SCHEMA_VERSION,getLocalHmacSecret,createDefaultHostAdapterRegistry,acquireRuntimeHttpCircuit,registerRuntimeHttpSuccess, ...

3`)}var Co=D(()=>{});function xt(){let e=dirname$1(fileURLToPath(import.meta.url)),t=[join$1(e,"..","plugin-files"),join$1(e,"plugin"),join$1(e,"..","..","dist","plugin-files"),join$1(e,"..","..","..","..","plugins","claude-code")];for(let n of t)if(existsSync$1(join$1(n,".claude-plugin","plugin.json")))return n;throw new Error("Plugin files not found. Run `

scripts/postinstall.jsView file

Lines 1-22javascript

1// packages/devflow/scripts/postinstall.js

2//

3// Auto-configures .claude/hooks.json in the consuming project so that Claude

4// Code invokes the devflow PreToolUse hook on every tool call.

5//

6// This file is plain ESM JavaScript (not TypeScript) because it must run during

7// `npm install` before any build step has compiled the package.

8//

9// If anything goes wrong we log a warning and exit 0 — we must never break a

10// user's `npm install`.

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hooks/user-prompt-submit.js#virtual:normalized:round1View on unpkg

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.18.24 matchedPath = dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.18.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/237-34a3fbfba7ff0de5.jsView on unpkg

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.18.24 matchedPath = dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.18.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/main-09803f06c26fe6d9.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

@devflow-tools/devflow@0.18.36

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code