Loading npm security reports…

@ganglia/cli@0.9.180: Suspicious npm security report (Warn) | LPM Firewall

registry / @ganglia/cli / 0.9.180

@ganglia/cli@0.9.180

Ganglia — MCP tools + Code Mode for every major AI coding assistant (Claude Code, Cursor, Windsurf, Cline, OpenCode, Continue, Zed, Codex CLI, Gemini CLI)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 2.15 KB of source, external domains: ganglia.dev

Source & flagged code

1 flagged

bin/gng.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// Ganglia CLI launcher.

3//

4// On install, npm's `optionalDependencies` only resolves the single platform

5// package that matches the user's OS + CPU — the other four fail to install

6// silently. At runtime we locate that package and spawn its binary.

8const { spawnSync } = require('child_process');

9const path = require('path');

11const PLATFORM = `${process.platform}-${process.arch}`;

13const PKG = {

14 'linux-x64': '@ganglia/cli-linux-x64',

15 'linux-arm64': '@ganglia/cli-linux-arm64',

16 'darwin-x64': '@ganglia/cli-darwin-x64',

17 'darwin-arm64': '@ganglia/cli-darwin-arm64',

18 'win32-x64': '@ganglia/cli-win32-x64',

19}[PLATFORM];

21if (!PKG) {

22 console.error(

23 `[ganglia] Unsupported platform: ${PLATFORM}\n` +

24 `Supported: linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64\n` +

25 `Or install manually: curl -fsSL https://ganglia.dev/install.sh | bash`,

26 );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/gng.jsView on unpkg · L7

27 process.exit(1);

Source & flagged code

1 flagged · loading source

bin/gng.jsView file

7L8: const { spawnSync } = require('child_process'); L9: const path = require('path'); L10: L11: const PLATFORM = `${process.platform}-${process.arch}`; L12: ... L24: `Supported: linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64\n` + L25: `Or install manually: curl -fsSL https://ganglia.dev/install.sh | bash`, L26: ); ... L53: stdio: 'inherit', L54: env: process.env, L55: windowsHide: false,

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code