registry / @geravant/sinain / 1.37.0

@geravant/sinain@1.37.0

⚠ Under review

Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 1.27 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.cerebras.ai, api.github.com, api.telegram.org, ar.sinain.com, auth.sinain.com, cdn.jsdelivr.net, docs.flutter.dev, github.com, huggingface.co, mcp.sinain.com, openrouter.ai, registry.npmjs.org, sinain.com, turn.sinain.com

Source & flagged code

9 flagged

package.jsonView file

Lines 1-33json

2 "name": "@geravant/sinain",

3 "version": "1.37.0",

4 "description": "Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.",

5 "type": "module",

6 "bin": {

7 "sinain": "./cli.js",

8 "sinain-knowledge": "./sinain-knowledge/deploy/cli.ts"

9 },

10 "scripts": {

11 "prepack": "node pack-prepare.js pre",

12 "postpack": "node pack-prepare.js post",

13 "postinstall": "node cli.js install --if-openclaw"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 },

15 "files": [

16 "cli.js",

17 "self-update.js",

18 "config.js",

19 "config-shared.js",

20 "encrypted-store.js",

21 "wipe-data.js",

22 "onboard.js",

23 "launcher.js",

24 "mcp-register.js",

25 "setup-overlay.js",

26 "setup-sck-capture.js",

27 "setup-embedding.js",

28 "setup-frpc.js",

29 "pack-prepare.js",

30 "install.js",

31 "index.ts",

32 "openclaw.plugin.json",

33 "sinain-memory",

sinain-core/src/capture/voice-session.tsView file

Lines 1-21typescript

1import { spawn, type ChildProcess } from "node:child_process";

2import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

sinain-core/src/capture/voice-session.tsView on unpkg · L1

3import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from

setup-embedding.jsView file

Lines 93-133javascript

93 _log("Force update requested — re-downloading model...");

94 }

96 // Verify sinain-core's node_modules are present (installDeps runs first in launcher)

97 const transformersPath = path.join(CORE_DIR, "node_modules", "@huggingface"

sinain-core/src/capture/window-ops.tsView file

Lines 6-46typescript

7/**

8 * Deliberate-capture window operations: assemble a time-range slice of the

9 * rolling window (feed + sense), describe its coverage for free (no LLM), and

10 * run the burst-lane gestures (summon → situation brief, enrich → context card).

11 */

13// One burst call handles ≤ ~60 min at median density (benchmarked: 34K tok

14// prefill = 1.38s on Cerebras). Beyond this we truncate oldest-first and flag

15// the brief as partial — honest coverage beats a stalled gesture.

sinain-core/src/mcp-tunnel/controller.tsView file

Lines 102-142typescript

102 void this.refreshAccount(); // reflect account link state in the panel

103 if (this.accountTimer) clearInterval(this.accountTimer);

104 this.accountTimer = setInterval(()

sinain-knowledge/adapters/openclaw/adapter.tsView file

Lines 9-49typescript

9import { readFileSync, writeFileSync, existsSync, statSync, copyFileSync } from "node:fs";

10import { join, dirname } from "node:path";

12import type { ScriptResult } from "../../data/schema.js";

13import

sense_client/sender.pyView file

•path = sense_client/sender.py kind = build_helper sizeBytes = 419 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

sense_client/sender.pyView on unpkg

sense_client/tests/__init__.pyView file

•path = sense_client/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

sense_client/tests/__init__.pyView on unpkg

Source & flagged code

9 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code