registry / @flotic/minitok / 1.4.17

@flotic/minitok@1.4.17

⚠ Under review

Verified coding workflows for the terminal

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 26 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 163 file(s), 1.37 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.minitok.dev, api.openai.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, minitok.dev, oauth2.googleapis.com, registry.npmjs.org, stream.camelai.com, www.googleapis.com, www.npmjs.com

Source & flagged code

18 flagged

package.jsonView file

Lines 1-34json

2 "name": "@flotic/minitok",

3 "version": "1.4.17",

4 "mcpName": "dev.minitok/minitok",

5 "description": "Verified coding workflows for the terminal",

6 "main": "src/index.js",

7 "bin": {

8 "minitok": "bin/minitok.js"

9 },

10 "publishConfig": {

11 "access": "public"

12 },

13 "scripts": {

14 "postinstall": "node scripts/postinstall-mcp.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "gui": "node bin/minitok.js gui",

16 "package:cli": "node scripts/artifact-report.mjs cli",

17 "sync:version-metadata": "node scripts/sync-version-metadata.mjs",

18 "check:version-metadata": "node scripts/sync-version-metadata.mjs --check",

19 "check:mcp-registry": "node scripts/mcp-registry-check.mjs",

20 "sync:extension-runtime": "npm run sync:version-metadata && node scripts/sync-extension-runtime.mjs",

21 "package:extension": "npm run sync:extension-runtime && node scripts/package-extension.mjs",

22 "release:extension": "npm run typecheck:extension && npm run extension:commercial:check && npm run extension:marketplace:check && npm run package:extension && npm run release:artifacts",

23 "typecheck:extension": "tsc -p extension/tsconfig.json",

24 "artifact:report": "node scripts/artifact-report.mjs report",

25 "artifact:runtime": "node scripts/artifact-report.mjs runtime",

26 "artifact:http": "node scripts/artifact-report.mjs http",

27 "demo:transcript": "node scripts/demo-transcript.mjs",

28 "community:preview": "node scripts/community-submission.mjs",

29 "promotion:preview": "node scripts/promotion-preview.mjs bundle",

30 "promotion:discovery": "node scripts/promotion-preview.mjs discovery",

31 "promotion:trust": "node scripts/promotion-preview.mjs trust",

32 "promotion:demo": "node scripts/promotion-demo.mjs",

33 "benchmark:goal": "node scripts/goal-benchmark.mjs",

34 "camelstream:live-smoke": "node scripts/camelstream-live-smoke.mjs",

README.mdView file

•Run `npm run readiness:all` for all three deterministic, local-only customer-facing checks. The authoritative generated VSIX is `extension/artifacts/minitok-extension-<extension-version>.vsix`; stale or unrelated VSIX candidates remain diagnostic only and are never deleted. `npm run readiness:checks` remains an alias. Use `node scripts/readiness-checks.mjs --target extension|cli|mcp --json` to run one surface. Stage 3 checks include versioned VSIX presence and manifest consistency, npm dry-run runtime files, bin and Node engine metadata, CLI help and non-TTY behavior, the packaged MCP stdio entrypoint and token-file session binding, plus localhost HTTP authentication, per-session isolation, and authenticated non-secret `/metrics` monitoring. `PASS` means local evidence was found, `BLOCKED`

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

src/cli/commands/auth.jsView file

Lines 88-121javascript

88async function customerLogout(server) {

89 const session = loadCustomerSession();

90 let remoteRevoked = false;

bin/minitok.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2"use strict";

3const { Command } = require("commander");

4const pkg = require("../package.json");

Medium

src/llm/provider.jsView file

Lines 1-25javascript

1"use strict";

3const FETCH_TIMEOUT_MS = 300000; // Allow slow reasoning providers up to five minutes

4const MAX_RESPONSE_BYTES = 2 * 1024 *

src/workspace/isolation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/workspace/isolation.js#virtual:normalized:round1View on unpkg

src/cli/gui-commands.jsView file

•matchType = normalized_sha256 matchedPackage = @flotic/minitok@1.4.16 matchedPath = src/cli/gui-commands.js matchedIdentity = npm:QGZsb3RpYy9taW5pdG9r:1.4.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High