registry / @diffexai/diffex / 0.3.1
@diffexai/diffex@0.3.1
Coding agent CLI with read, bash, edit, write, update_plan tools and session management
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe credential-to-gist scanner hits are explained by help text listing credential environment variables near the share URL setting. The actual share flow requires `/share` and uploads an exported session as a private gist; analytics is opt-in and defaults off.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Sharing requires the explicit `/share` command; analytics requires opt-in.
Impact
No unsolicited credential or unrelated data transmission was identified.
Mechanism
The share command uses GitHub CLI to create a private gist from an exported session. Analytics defaults off.
AI rationale
The credential-to-gist scanner hits are explained by help text listing credential environment variables near the share URL setting. The actual share flow requires `/share` and uploads an exported session as a private gist; analytics is opt-in and defaults off.
Network endpoints1
gist.github.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Sharing runs only when the user enters `/share`.
- Sharing checks GitHub CLI authentication and creates a private gist from an exported session.
- Analytics offers an explicit opt-in, and its setting defaults to false.
- The manifest defines CLI, import, and export entry points.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file
•path = dist/node_modules/@diffexai/diffex-[redacted]-x64/darwin-modifiers.node
kind = native_binary
sizeBytes = 12776
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
dist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkgdist/config.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/config.js#virtual:string-array:round1View on unpkgFindings
5 High4 Medium3 Low
HighSemantic Analysis Limiteddist/config.js#virtual:string-array:round1
HighKnown Malware Source Similaritydist/core/resolve-config-value.js
HighKnown Malware Source Similaritydist/modes/rpc/rpc-client.js
HighKnown Malware Source Similaritydist/utils/clipboard.js
HighPrevious Version Dangerous Deltadist/utils/shell.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/node_modules/@diffexai/diffex-tui/native/darwin/prebuilds/darwin-x64/darwin-modifiers.node
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @diffexai/diffex@0.3.1.
See all versions of @diffexai/diffex for other recorded verdicts.
- Review the evidence and your use of @diffexai/diffex@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.