registry / @herald-ai/herald / 0.1.40

@herald-ai/herald@0.1.40

AI DevOps agent for developers working from the terminal

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 208 file(s), 1.26 MB of source, external domains: 127.0.0.1, api.eu.newrelic.com, api.githubcopilot.com, api.herald.dev, api.motherduck.com, api.newrelic.com, api.supabase.com, app.herald.dev, astral.sh, clouderrorreporting.googleapis.com, console.cloud.google.com, dashboards.runllm.com, docs.astral.sh, gateway.runllm.com, grafana.example.com, herald.dev, mcp.eu.newrelic.com, mcp.honeycomb.io, mcp.newrelic.com, mcp.render.com, monitoring.googleapis.com, my-deployment.kb.us-central1.gcp.elastic.cloud, nodejs.org, one.eu.newrelic.com, one.newrelic.com, portal.azure.com, registry.npmjs.org, splunk.example.com, supabase.com, www.googleapis.com

Source & flagged code

4 flagged

dist/screens/Investigation.jsView file

Lines 1-22javascript

1import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";

2import { useCallback, useEffect, useMemo, useRef, useState } from "react";

3import { spawn } from "node:child_process";

4import { Box, Static, Text, useApp, useInput } from "ink";

High

Child Process

Package source references child process execution.

dist/screens/Investigation.jsView on unpkg · L2

5import { useWindowSize } from "../lib/ink-compat.js";

6import { colors } from "../theme.js";

7import { StepSection, PromptedInput, SlashMenu, StatusLine, useSlashMenu, KeyHints, } from "../components/index.js";

8import { loadLiteConfig } from "../lib/config.js";

9import { loadLiteCredentials } from "../lib/credentials.js";

10import { saveHistory, clearHistory, loadHistory } from "../lib/history.js";

11import { getRepoMetadata } from "../lib/repo.js";

12import { detectLiteTools } from "../lib/tool-detect.js";

13import { getActiveGcpProject } from "../lib/gcp-discover.js";

14import { scanRepo, buildToolSuggestions } from "../lib/repo-scan.js";

15import { offsetToLineCol } from "../components/PromptedInput.js";

16import { TOOL_GCP_OBSERVABILITY } from "../lib/tool-ids.js";

17import { useLiteSession } from "../components/hooks/useLiteSession.js";

18import { useMockSession } from "../components/hooks/useMockSession.js";

19import { SystemArchBanner, SystemArchOverlay, SymbolsMenu, MentionCards, useSymbolsMenu } from "../components/index.js";

20import { buildArchRows, buildMentionsSuffix, extractMentionedComponents } from "../lib/system-arch.js";

21import { DEV_CONFIG, DEV_CREDENTIALS } from "../lib/dev-mode.js";

22import { buildSharePayload, CLI_VERSION } from "../lib/share.js";

Lines 251-291javascript

251 if (question)

252 next.push({ id: "question", data: question });

253 const lines = [...session.thinkingLines];

254 if (lines.length)

255 next.push({ id: "thinking", data: lines });

256 if (session.toolCalls.length)

bin/herald.jsView file

Lines 1-7javascript

1#!/usr/bin/env node

2import { resolve, dirname } from 'path';

3import { fileURLToPath } from 'url';

5const __dirname = dirname(fileURLToPath(import.meta.url));

6await import(

dist/main.jsView file

Lines 250-281javascript

250 process.stdout.write("\x1Bc");

251 const { waitUntilExit } = render(React.createElement(Configure, { interactive }), { exitOnCtrlC: true, stdout: syncStdout });

252 await waitUntilExit();

253 process.exit(0);

254}

Source & flagged code

4 flagged · loading source

dist/screens/Investigation.jsView file

2import { useCallback, useEffect, useMemo, useRef, useState } from "react"; L3: import { spawn } from "node:child_process"; L4: import { Box, Static, Text, useApp, useInput } from "ink";

High

Child Process

Package source references child process execution.

dist/screens/Investigation.jsView on unpkg · L2

271const startMs = Date.now(); L272: const proc = spawn(cmd, { shell: true }); L273: shellProcRef.current = proc;

High

Shell

Package source references shell execution.

dist/screens/Investigation.jsView on unpkg · L271

bin/herald.jsView file

5const __dirname = dirname(fileURLToPath(import.meta.url)); L6: await import(resolve(__dirname, '../dist/main.js'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/herald.jsView on unpkg · L5

dist/main.jsView file

270if (wasUpgradeRequested()) { L271: const { spawnSync } = await import("node:child_process"); L272: process.stdout.write("\nRunning: npm install -g @herald-ai/herald\n\n"); L273: const result = spawnSync("npm", ["install", "-g", "@herald-ai/herald"], { stdio: "inherit" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/main.jsView on unpkg · L270

Findings

3 High4 Medium5 Low

HighChild Processdist/screens/Investigation.js

HighShelldist/screens/Investigation.js

HighRuntime Package Installdist/main.js

MediumDynamic Requirebin/herald.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings