registry / @devflow-tools/devflow / 0.13.2

@devflow-tools/devflow@0.13.2

⚠ Under review

DevFlow - Developer Intelligence Platform (Distribution Package)

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 79.6 KB of source, external domains: 127.0.0.1

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

2 "name": "@devflow-tools/devflow",

3 "version": "0.13.2",

4 "type": "module",

5 "description": "DevFlow - Developer Intelligence Platform (Distribution Package)",

6 "bin": {

7 "devflow": "./bin/devflow"

8 },

9 "scripts": {

10 "build": "tsup",

11 "build:watch": "tsup --watch",

12 "clean": "rm -rf dist",

13 "postbuild": "cp ../../apps/server/public/fallback.html dist/fallback.html && npx tsx scripts/bundle-plugin.ts && mkdir -p ../../plugins/claude-code/dist/hooks && cp dist/hooks/*.js ../../plugins/claude-code/dist/hooks/",

14 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "dependencies": {

17 "@colbymchenry/codegraph": "^1.1.1",

18 "@devflow-tools/adapters": "^0.13.1",

19 "@devflow-tools/benchmark": "^0.13.1",

20 "@devflow-tools/context-engine": "^0.13.1",

21 "@devflow-tools/database": "^0.13.1",

22 "@devflow-tools/knowledge-engine": "^0.13.1",

23 "@devflow-tools/mcp-server": "^0.13.1",

24 "@devflow-tools/memory-engine": "^0.13.1",

25 "@devflow-tools/sdk": "^0.13.1",

26 "@devflow-tools/server": "^0.13.1",

27 "@devflow-tools/telemetry": "^0.13.1",

28 "@devflow-tools/workflow-engine": "^0.13.1",

29 "@inquirer/prompts": "^7.10.1",

30 "@modelcontextprotocol/sdk": "^1.0.0",

31 "@nestjs/common": "^10.4.0",

32 "@nestjs/core": "^10.4.0",

33 "@nestjs/platform-fastify": "^10.4.0",

34 "chalk": "^5.3.0",

dist/hooks/hook-daemon.jsView file

Lines 1-8javascript

1import {createServer}from'net';import {join,dirname}from'path';import {homedir}from'os';import {existsSync,unlinkSync,readdirSync,readFileSync,mkdirSync,writeFileSync}from'fs';import {createHash}from'crypto';import {request}

scripts/postinstall.jsView file

Lines 1-21javascript

1// packages/devflow/scripts/postinstall.js

2//

3// Auto-configures .claude/hooks.json in the consuming project so that Claude

4// Code invokes the devflow PreToolUse hook on every tool call.

5//

6// This file is plain ESM JavaScript (not TypeScript) because it must run during

7// `npm install` before any build step has compiled the package.

8//

9// If anything goes wrong we log a warning and exit 0 — we must never break a

10// user's `npm install`.

dist/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import Ro,{readFileSync,existsSync,mkdirSync,writeFileSync,unlinkSync,statSync,cpSync,readdirSync,rmSync}from'fs';import Hn,{dirname,join,resolve}from'path';import {homedir}from'os';import {createRequire}from'module';import be from'@colbymchenry/codegraph';

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code