registry  /  @hasna/calendar  /  0.2.1

@hasna/calendar@0.2.1

Universal calendar management for AI coding agents - CLI + MCP server + interactive TUI

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 1.31 MB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = mkdir -p $HOME/.hasna/calendar $HOME/.hasna/calendar/templates 2>/dev/null || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = mkdir -p $HOME/.hasna/calendar $HOME/.hasna/calendar/templates 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/server/index.jsView file
16744sourceCode = this.opts.code.process(sourceCode, sch); L16745: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L16746: const validate = makeValidate(this, this.scope.get());
High
Eval

Package source references dynamic code evaluation.

dist/server/index.jsView on unpkg · L16744

Findings

2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEvaldist/server/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings