registry / @flotic/minitok / 1.4.0

@flotic/minitok@1.4.0

Verified repository-aware coding workflow CLI for AI agents

Static Scan Results

scanned 24d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 102 file(s), 623 KB of source, external domains: api.anthropic.com, api.minitok.dev, api.openai.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, minitok.dev, oauth2.googleapis.com, registry.npmjs.org, www.googleapis.com, www.npmjs.com

Source & flagged code

5 flagged

README.mdView file

•Run `npm run readiness:all` for all three deterministic, local-only customer-facing checks. The authoritative generated VSIX is `extension/artifacts/minitok-extension-<extension-version>.vsix`; stale or unrelated VSIX candidates remain diagnostic only and are never deleted. `npm run readiness:checks` remains an alias. Use `node scripts/readiness-checks.mjs --target extension|cli|mcp --json` to run one surface. Stage 3 checks include versioned VSIX presence and manifest consistency, npm dry-run runtime files, bin and Node engine metadata, CLI help and non-TTY behavior, the packaged MCP stdio entrypoint and token-file session binding, plus localhost HTTP authentication, per-session isolation, and authenticated non-secret `/metrics` monitoring. `PASS` means local evidence was found, `BLOCKED`

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

src/cli/commands/auth.jsView file

Lines 68-100javascript

68 const status = t.valid ? "valid" : "expired";

69 const refresh = t.has_refresh ? " (has refresh token)" : "";

70 const expiry = t.expires_at ? " expires: " + t.expires_at : "";

71 // A credential saved before aliases were normalised is keyed by the alias

72 // (gpt.json) and still resolves through the token store's fallback, but the

73 // canonical name is what the CLI and the resolver use from now on.

74 const legacy = ALIAS_MAP[t.provider] ? ` [alias of ${ALIAS_MAP[t.provider]} — re-run: minitok auth login ${ALIAS_MAP[t.provider]}]` : "";

75 console.log(" " + t.provider.padEnd(16) + status + refresh + expiry + legacy);

76 }

77 console.log("\nRun: minitok auth login <provider> to add/update credentials");

78 return 0;

79}

81async function cmdAuthLogout(provider) {

82 if (!provider) { console.error("Usage: minitok auth logout <provider>"); return 1; }

83 const name = normalizeProvider(provider); tokenStore.remove(name); afterCredentialChange(); console.log("Logged out from " + name + "."); return 0;

84}

86function addCustomerLogin(command, description) {

87 const login = command.command("customer-login").description(description).argument("[email]", "Customer email").option("--email-env <name>", "Read customer email from an environment variable").option("--password-env <name>", "Read customer password from an environment variable").option("--server <url>"

88 login.action(async (email, options) => { const resolvedEmail = email || (options.emailEnv && process.env[options.emailEnv]); const value = options.passwordEnv ? process.env[options.passwordEnv] : await prompt(

89}

91function register(program) {

92 const authCmd = program.command("auth").description("Manage provider and customer authentication");

93 authCmd.command("login").description("Log in to an LLM provider (OAuth or API key)").argument("<provider>", "Provider name (anthropic, openai, google; aliases claude, gpt, gemini accepted)").action(async provider => { process.exit(await cmdAuthLogin(provider)); });

94 addCustomerLogin(authCmd, "Log in to the minitok customer account for billing commands");

95 authCmd.command("status").description("Show stored credentials and their validity").action(async () => { process.exit(await cmdAuthStatus()); });

96 authCmd.command("logout").description("Remove stored credentials for a provider").argument("<provider>", "Provider name").action(async provider => { process.exit(await cmdAuthLogout(provider)); });

97}

99module.exports = { cmdAuthLogin, cmdAuthCustomerLogin, cmdAuthStatus, cmdAuthLogout, register };

100

src/llm/provider.jsView file

Lines 1-25javascript

1"use strict";

3const FETCH_TIMEOUT_MS = 300000; // Allow slow reasoning providers up to five minutes

4const MAX_RESPONSE_BYTES = 2 * 1024 *

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/cli/gui-commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @flotic/minitok@1.3.12 matchedIdentity = npm:QGZsb3RpYy9taW5pdG9r:1.3.12 similarity = 0.505 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/gui-commands.jsView on unpkg

Source & flagged code

5 flagged · loading source

@flotic/minitok@1.4.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code