registry / @golproductions/check / 3.3.6

@golproductions/check@3.3.6

Update to the latest: npx @golproductions/check@latest --install

Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

Manifest

NoLicense

scanned 2 file(s), 33.5 KB of source, external domains: github.com, golproductions.com, pub-e55366a7f5994be9be04f0e205179f4a.r2.dev, triage.golproductions.com, www.golproductions.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{readFileSync as e,writeFileSync as o,mkdirSync as t,existsSync as n,createWriteStream as s,chmodSync as r,unlinkSync as c,rmSync as i}from"node:fs";import{spawnSync as a,spawn as l}from"node:child_process";import{createServer as h,connect as d}from"node:net";import{fileURLToPath as u}from"node:url";import{join as m}from"node:path";import{homedir as p,platform as f,arch as g}from"node:os";import{pipeline as k}from"node:stream/promises";import{Readable as y}from"node:stream";const w=(()=>{try{return JSON.parse(e(m(u(new URL(".",import.meta.url)),"..","package.json"),"utf8")).version}catch ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

dist/mcp.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{McpServer as t}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as e}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as r}from"zod";import{execFile as n,spawn as

Source & flagged code

3 flagged · loading source

dist/index.jsView file

@golproductions/check@3.3.6

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code