registry  /  @dzhechkov/harness-cli  /  0.3.170

@dzhechkov/harness-cli@0.3.170

⚠ Under review

The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 6 file(s), 266 KB of source, external domains: api.github.com, raw.githubusercontent.com

Source & flagged code

3 flagged · loading source
dist/cli.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @dzhechkov/harness-cli@0.3.129 matchedIdentity = npm:QGR6aGVjaGtvdi9oYXJuZXNzLWNsaQ:0.3.129 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg
7import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'; L8: import { execSync } from 'node:child_process'; L9: import { homedir } from 'node:os';
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L7
628try { L629: execSync(`npm install ${pkg} --save-dev --no-fund --no-audit`, { cwd: projectRoot, stdio: 'pipe', encoding: 'utf-8' }); L630: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L628

Findings

1 Critical3 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShell
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings