registry / @hipmmai/hipmmcode / 0.17.2

@hipmmai/hipmmcode@0.17.2

Provider-agnostic AI coding agent for your terminal (binary distribution)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 3.49 KB of source, external domains: github.com

Source & flagged code

2 flagged

package.jsonView file

Lines 1-29json

2 "name": "@hipmmai/hipmmcode",

3 "version": "0.17.2",

4 "description": "Provider-agnostic AI coding agent for your terminal (binary distribution)",

5 "bin": {

6 "hipmmcode": "bin/run.js"

7 },

8 "scripts": {

9 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "files": [

12 "bin/run.js",

13 "install.js",

14 "README.md"

15 ],

16 "os": [

17 "darwin",

18 "linux",

19 "win32"

20 ],

21 "license": "SEE LICENSE IN https://github.com/HiPMMAI/hipmmcode/blob/main/LICENSE.txt",

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/HiPMMAI/hipmmcode.git"

25 },

26 "homepage": "https://github.com/HiPMMAI/hipmmcode",

27 "publishConfig": {

28 "access": "public"

29 }

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

@hipmmai/hipmmcode@0.17.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code