registry / @flotic/minitok / 1.3.12

@flotic/minitok@1.3.12

Verified repository-aware coding workflow CLI for AI agents

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 98 file(s), 482 KB of source, external domains: api.anthropic.com, api.minitok.dev, api.openai.com, cognitiveservices.azure.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, login.microsoftonline.com, minitok.dev, oauth2.googleapis.com, openrouter.ai, registry.npmjs.org, www.googleapis.com, www.npmjs.com

Source & flagged code

5 flagged

README.mdView file

•Run `npm run readiness:all` for all three deterministic, local-only customer-facing checks. The authoritative generated VSIX is `extension/artifacts/minitok-extension-<extension-version>.vsix`; stale or unrelated VSIX candidates remain diagnostic only and are never deleted. `npm run readiness:checks` remains an alias. Use `node scripts/readiness-checks.mjs --target extension|cli|mcp --json` to run one surface. Stage 3 checks include versioned VSIX presence and manifest consistency, npm dry-run runtime files, bin and Node engine metadata, CLI help and non-TTY behavior, the packaged MCP stdio entrypoint and token-file session binding, plus localhost HTTP authentication, per-session isolation, and authenticated non-secret `/metrics` monitoring. `PASS` means local evidence was found, `BLOCKED`

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

src/cli/commands/auth.jsView file

Lines 43-75javascript

43 console.log("\nAPI key saved for " + name + ".");

44 return 0;

45}

47async function cmdAuthStatus() {

48 const tokens = tokenStore.list();

49 if (tokens.length === 0) { console.log("No stored credentials."); console.log("\nRun: minitok auth login <provider>"); return 0; }

50 console.log("Stored credentials:\n");

51 for (const t of tokens) { const status = t.valid ? "valid" : "expired"; const refresh = t.has_refresh ? " (has refresh token)" : ""

52 console.log("\nRun: minitok auth login <provider> to add/update credentials");

53 return 0;

54}

56async function cmdAuthLogout(provider) {

57 if (!provider) { console.error("Usage: minitok auth logout <provider>"); return 1; }

58 const name = provider.toLowerCase(); tokenStore.remove(name); console.log("Logged out from " + name + "."); return 0;

59}

61function addCustomerLogin(command, description) {

62 const login = command.command("customer-login").description(description).argument("[email]", "Customer email").option("--email-env <name>", "Read customer email from an environment variable").option("--password-env <name>", "Read customer password from an environment variable").option("--server <url>"

63 login.action(async (email, options) => { const resolvedEmail = email || (options.emailEnv && process.env[options.emailEnv]); const value = options.passwordEnv ? process.env[options.passwordEnv] : await prompt(

64}

66function register(program) {

67 const authCmd = program.command("auth").description("Manage provider and customer authentication");

68 authCmd.command("login").description("Log in to an LLM provider (OAuth or API key)").argument("<provider>", "Provider name (anthropic, openai, github, etc.)").action(async provider => { process.exit(await cmdAuthLogin(provider)); });

69 addCustomerLogin(authCmd, "Log in to the minitok customer account for billing commands");

70 authCmd.command("status").description("Show stored credentials and their validity").action(async () => { process.exit(await cmdAuthStatus()); });

71 authCmd.command("logout").description("Remove stored credentials for a provider").argument("<provider>", "Provider name").action(async provider => { process.exit(await cmdAuthLogout(provider)); });

72}

74module.exports = { cmdAuthLogin, cmdAuthCustomerLogin, cmdAuthStatus, cmdAuthLogout, register };

src/llm/provider.jsView file

Lines 1-25javascript

1"use strict";

3const FETCH_TIMEOUT_MS = 300000; // Allow slow reasoning providers up to five minutes

4const MAX_RESPONSE_BYTES = 2 * 1024 *

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/auth/oauth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flotic/minitok@1.3.7 matchedIdentity = npm:QGZsb3RpYy9taW5pdG9r:1.3.7 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth/oauth.jsView on unpkg

Source & flagged code

5 flagged · loading source

@flotic/minitok@1.3.12

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code