registry / @duckmind/dm-darwin-arm64 / 0.42.5

@duckmind/dm-darwin-arm64@0.42.5

DuckMind (dm) binary payload for darwin arm64

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 168 file(s), 2.64 MB of source, external domains: api.github.com, api.openai.com, chatgpt.com, clerk.consensus.app, consensus.app, copilot.microsoft.com, doi.org, example.com, gemini.google.com, github.com, logically.app, openrouter.ai, raw.githubusercontent.com, shittycodingagent.ai, www.google.com, www.perplexity.ai, www.semanticscholar.org

Source & flagged code

8 flagged

extensions/dm-subagents/install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{execSync as z}from"node:child_process";import*as j from"node:fs";import*as q from"node:path";import*as B from"node:os";var b=q.join(B.homedir(),".dm","agent","extensions","subagent"),J="https://github.com/nicobailon/dm-subagents.git",w=process.argv.slice(2),K=w.includes("--remove")||w.includes("-r"),M=w.includes("--help")||w.includes("-h");if(M)console.log(`

3dm-subagents - DM extension for delegating tasks to subagents

High

Child Process

Package source references child process execution.

extensions/dm-subagents/install.mjsView on unpkg · L1

5Usage:

6 npx dm-subagents Install the extension

7 npx dm-subagents --remove Remove the extension

8 npx dm-subagents --help Show this help

10Installation directory: ${b}

11`),process.exit(0);if(K){if(j.existsSync(b))console.log(`Removing ${b}...`),j.rmSync(b,{recursive:!0}),console.log("dm-subagents removed");else console.log("dm-subagents is not installed");process.exit(0)}console.log(`Installing dm-subagents...

12`);var A=q.dirname(b);if(!j.existsSync(A))j.mkdirSync(A,{recursive:!0});if(j.existsSync(b))if(j.existsSync(q.join(b,".git"))){console.log("Updating existing installation...");try{z("git pull",{cwd:b,stdio:"inherit"}),console.log(

13dm-subagents updated`)}catch(Q){console.error("Failed to update. Try removing and reinstalling:"),console.error(" npx dm-subagents --remove && npx dm-subagents"),process.exit(1)}}else console.log(`Directory exists but is not a git repo: ${b}`),console.log("Remove it first with: npx dm-subagents --remove"),process.exit(1);else{console.log(`Cloning to ${b}...`);try{z(`git clone ${

14dm-subagents installed`)}catch(G){console.error("Failed to clone repository"),process.exit(1)}}console.log(`

15The extension is now available in pi. Tools added:

16 • subagent - Delegate tasks to agents and inspect run status

17 • wait - Block until background subagent runs finish (delivers their results)

19Documentation: ${b}/README.md

20`);

extensions/dm-subagents/src/runs/shared/acceptance.tsView file

Lines 704-744typescript

704 ...blockers.map((result) => `${result.agent}: ${result.error ?? "child or acceptance gate failed"}`),

705 ]),

706 noStagedFiles: childReports.length > 0 &&

extensions/dm-subagents/src/runs/background/subagent-runner.tsView file

Lines 139-179typescript

139 skipped?: boolean;

140 interrupted?: boolean;

141 timedOut?: boolean;

142 turnBudget?: TurnBudgetState;

143 turnBudgetExceeded?: boolean;

144 wrapUpRequested?: boolean;

145 toolBudget?: ToolBudgetState;

146

extensions/dm-image2/index.jsView file

Lines 1-10javascript

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

photon_rs_bg.wasmView file

•path = photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

photon_rs_bg.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg

Source & flagged code

8 flagged · loading source

extensions/dm-subagents/install.mjsView file

1#!/usr/bin/env node L2: import{execSync as z}from"node:child_process";import*as j from"node:fs";import*as q from"node:path";import*as B from"node:os";var b=q.join(B.homedir(),".dm","agent","extensions","s... L3: dm-subagents - DM extension for delegating tasks to subagents

High

Child Process

Package source references child process execution.

extensions/dm-subagents/install.mjsView on unpkg · L1

extensions/dm-subagents/src/runs/shared/acceptance.tsView file

724env: { ...process.env, ...(command.env ?? {}) }, L725: shell: true, L726: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

extensions/dm-subagents/src/runs/shared/acceptance.tsView on unpkg · L724

extensions/dm-subagents/src/runs/background/subagent-runner.tsView file

159structuredOutputSchemaPath?: string; L160: acceptance?: import("../../shared/types.ts").AcceptanceLedger; L161: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

extensions/dm-subagents/src/runs/background/subagent-runner.tsView on unpkg · L159

extensions/dm-image2/index.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

extensions/dm-image2/index.jsView on unpkg · L1

1import{existsSync as X$}from"node:fs";import{join as f$}from"node:path";import{Type as D}from"@sinclair/typebox";import{getAgentDir as H1}from"@duckmind/dm-coding-agent";import{ran... L2: `)}function x$($,j){let Y=F[j]??F[P];return[$,`Output in exactly ${Y.width}px x ${Y.height}px (${j}).`,"Prefer production-ready composition, grounded local detail when relevant, an... L3: `)}function j$($,j){let Y=F[j]??F[P];return[$,`Target aspect ratio: ${j}.`,`Compose for roughly ${Y.width}x${Y.height} output.`,"Generate the final answer by calling the image_gene... L4: `)}function A$($){let j=String($??"").trim();if(!j)throw Error("Codex returned an empty image response.");let Y=j.match(/!\[[^\]]*]$(data:image\/svg\+xml[^)]+)$/i);if(Y?.[1]){let... L5: `));if(f==="response.output_text.delta"&&typeof K.delta==="string")V+=K.delta;if(f==="response.output_item.done"&&K.item&&typeof K.item==="object")B.push(K.item);if(f==="response.c... L6: `);if(_===-1)break;let J=X.slice(0,_);if(X=X.slice(_+1),J.endsWith("\r"))J=J.slice(0,-1);if(!J){if(U())return{assistantText:V.trim(),outputItems:B,responseId:z};continue}if(J.start... L7: `),j}function Z$(){let $=[],j=new Set;for(let[Y,Z]of[["env:auth_file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

extensions/dm-image2/index.jsView on unpkg · L1

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

photon_rs_bg.wasmView file

•path = photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

photon_rs_bg.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg

Findings

4 High8 Medium3 Low

HighChild Processextensions/dm-subagents/install.mjs

HighShellextensions/dm-subagents/src/runs/shared/acceptance.ts

HighSame File Env Network Executionextensions/dm-image2/index.js

HighCommand Output Exfiltrationextensions/dm-image2/index.js

MediumDynamic Requireextensions/dm-subagents/src/runs/background/subagent-runner.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydm

MediumShips Wasm Modulephoton_rs_bg.wasm

MediumShips Build Helperextensions/dm-image2/vendor/imagen/context_init.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

extensions/dm-subagents/install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3dm-subagents - DM extension for delegating tasks to subagents

High

Child Process

Package source references child process execution.

extensions/dm-subagents/install.mjsView on unpkg · L1

5Usage:

6 npx dm-subagents Install the extension

7 npx dm-subagents --remove Remove the extension

8 npx dm-subagents --help Show this help

10Installation directory: ${b}

14dm-subagents installed`)}catch(G){console.error("Failed to clone repository"),process.exit(1)}}console.log(`

15The extension is now available in pi. Tools added:

16 • subagent - Delegate tasks to agents and inspect run status

17 • wait - Block until background subagent runs finish (delivers their results)

19Documentation: ${b}/README.md

20`);

extensions/dm-subagents/src/runs/shared/acceptance.tsView file

Lines 704-744typescript

704 ...blockers.map((result) => `${result.agent}: ${result.error ?? "child or acceptance gate failed"}`),

705 ]),

706 noStagedFiles: childReports.length > 0 &&

extensions/dm-subagents/src/runs/background/subagent-runner.tsView file

Lines 139-179typescript

139 skipped?: boolean;

140 interrupted?: boolean;

141 timedOut?: boolean;

142 turnBudget?: TurnBudgetState;

143 turnBudgetExceeded?: boolean;

144 wrapUpRequested?: boolean;

145 toolBudget?: ToolBudgetState;

146

extensions/dm-image2/index.jsView file

Lines 1-10javascript

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

photon_rs_bg.wasmView file

•path = photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

photon_rs_bg.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg