registry / @eventmodelers/cli / 1.0.45
@eventmodelers/cli@1.0.45
Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, Cratis, or modeling-only)
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedstacks/bridge/templates/bridge/ralph-claude.jsView file
8import { startRalph, loadLocalConfig } from './lib/ralph.js';
L9: import { spawn } from 'child_process';
L10: import { dirname, resolve } from 'path';
High
Child Process
Package source references child process execution.
stacks/bridge/templates/bridge/ralph-claude.jsView on unpkg · L8stacks/bridge/templates/bridge/ralph-hook.jsView file
68cwd: projectDir,
L69: shell: true,
L70: stdio: 'inherit',
High
Shell
Package source references shell execution.
stacks/bridge/templates/bridge/ralph-hook.jsView on unpkg · L68stacks/bridge/templates/bridge/ralph-static.jsView file
Findings
6 High5 Medium3 Low
HighChild Processstacks/bridge/templates/bridge/ralph-claude.js
HighShellstacks/bridge/templates/bridge/ralph-hook.js
HighSame File Env Network Executionshared/build-kit/code-export.mjs
HighExternal Ai Agent Control Surface Mutationcli.js
HighSemantic Analysis Limitedlib/adapters/spec-kitty-adapter.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltacli.js
MediumDynamic Requirestacks/bridge/templates/bridge/ralph-static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/axon/templates/root/mvnw.cmd
MediumStructural Risk Force Deep Review
LowFilesystem
Affected versions and remediation
This report applies to @eventmodelers/cli@1.0.45.
See all versions of @eventmodelers/cli for other recorded verdicts.
- Review the evidence and your use of @eventmodelers/cli@1.0.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.