registry / @golproductions/check / 3.3.3

@golproductions/check@3.3.3

⚠ Under review

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

Manifest

NoLicense

scanned 2 file(s), 32.1 KB of source, external domains: github.com, golproductions.com, pub-e55366a7f5994be9be04f0e205179f4a.r2.dev, triage.golproductions.com, www.golproductions.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{readFileSync as e,writeFileSync as o,mkdirSync as t,existsSync as n,createWriteStream as s,chmodSync as r,unlinkSync as c,rmSync as i}from"node:fs";import{spawnSync as a,spawn as l}from"node:child_process";import{createServer as d,connect as h}from"node:net";import{fileURLToPath as u}from"node:url";import{join as m}from"node:path";import{homedir as p,platform as f,arch as k}from"node:os";import{pipeline as g}from"node:stream/promises";import{Readable as y}from"node:stream";const v="3.2.26",w="https://triage.golproductions.com/preflight",C=process.env.GOL_CLIENT_ID||"";function T(){if(C) ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @golproductions/check@3.2.25 matchedIdentity = npm:QGdvbHByb2R1Y3Rpb25zL2NoZWNr:3.2.25 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/mcp.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{McpServer as t}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as e}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as r}from"zod";import{execFile as n,spawn as

Source & flagged code

4 flagged · loading source

dist/index.jsView file

@golproductions/check@3.3.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code