registry / @howaboua/pi-codex-conversion / 2.2.0

@howaboua/pi-codex-conversion@2.2.0

Codex-oriented tool and prompt adapter for pi coding agent

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 247 file(s), 1.29 MB of source, external domains: api.openai.com, auth.openai.com, chatgpt.com, discord.com, github.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/providers/openai-codex/node-runtime.jsView file

Lines 1-28javascript

1var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {

2 if (typeof path === "string" && /^\.\.?\//.test(path)) {

3 return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {

4 return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");

5 });

6 }

7 return path;

8};

9const dynamicImport = (specifier) => import(__rewriteRelativeImportExtension(specifier));

10let fsPromisesPromise;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/openai-codex/node-runtime.jsView on unpkg · L8

11export async function getNodeFsPromises() {

12 if (!fsPromisesPromise) {

13 fsPromisesPromise = dynamicImport("node:fs/promises");

14 }

15 return fsPromisesPromise;

16}

17export function getNodeFsSync() {

18 if (typeof process === "undefined" || !(process.versions?.node || process.versions["bun"])) {

19 return null;

20 }

21 const builtinProcess = process;

22 if (typeof builtinProcess.getBuiltinModule !== "function") {

23 return null;

24 }

25 try {

26 const module = builtinProcess.getBuiltinModule("node:fs");

27 if (typeof module?.readFileSync !== "function")

28 return null;

dist/ui/settings/links.jsView file

Lines 1-15javascript

1import { spawn } from "node:child_process";

2export const GITHUB_URL = "https://github.com/IgorWarzocha/howaboua-pi-stuff/tree/main/packages/pi-codex-conversion";

3export const CHANGELOG_URL = `${GITHUB_URL}/CHANGELOG.md`;

4export const DISCORD_URL

src/tools/view-image/bin/win32-arm64/view_image.exeView file

•path = src/tools/view-image/bin/win32-arm64/view_image.exe kind = native_binary sizeBytes = 1199616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/tools/view-image/bin/win32-arm64/view_image.exeView on unpkg

bin/apply_patch.cmdView file

•path = bin/apply_patch.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/apply_patch.cmdView on unpkg

examples/custom-tools/spawn-agent/spawn-agent.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @howaboua/pi-codex-conversion@2.1.7 matchedIdentity = npm:[redacted]:2.1.7 similarity = 0.550 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

examples/custom-tools/spawn-agent/spawn-agent.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/providers/openai-codex/node-runtime.jsView file

8}; L9: const dynamicImport = (specifier) => import(__rewriteRelativeImportExtension(specifier)); L10: let fsPromisesPromise;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/openai-codex/node-runtime.jsView on unpkg · L8

dist/ui/settings/links.jsView file

1import { spawn } from "node:child_process"; L2: export const GITHUB_URL = "https://github.com/IgorWarzocha/howaboua-pi-stuff/tree/main/packages/pi-codex-conversion"; L3: export const CHANGELOG_URL = `${GITHUB_URL}/CHANGELOG.md`; ... L6: export function openExternalUrl(url) { L7: const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open"; L8: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ui/settings/links.jsView on unpkg · L1

src/tools/view-image/bin/win32-arm64/view_image.exeView file

•path = src/tools/view-image/bin/win32-arm64/view_image.exe kind = native_binary sizeBytes = 1199616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/tools/view-image/bin/win32-arm64/view_image.exeView on unpkg

bin/apply_patch.cmdView file

•path = bin/apply_patch.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/apply_patch.cmdView on unpkg

examples/custom-tools/spawn-agent/spawn-agent.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

examples/custom-tools/spawn-agent/spawn-agent.mjsView on unpkg

Findings

2 High6 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/ui/settings/links.js

HighPrevious Version Dangerous Deltaexamples/custom-tools/spawn-agent/spawn-agent.mjs

MediumDynamic Requiredist/providers/openai-codex/node-runtime.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarysrc/tools/view-image/bin/win32-arm64/view_image.exe

MediumShips Build Helperbin/apply_patch.cmd

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/providers/openai-codex/node-runtime.jsView file

Lines 1-28javascript

1var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {

2 if (typeof path === "string" && /^\.\.?\//.test(path)) {

3 return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {

4 return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");

5 });

6 }

7 return path;

8};

9const dynamicImport = (specifier) => import(__rewriteRelativeImportExtension(specifier));

10let fsPromisesPromise;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/openai-codex/node-runtime.jsView on unpkg · L8

11export async function getNodeFsPromises() {

12 if (!fsPromisesPromise) {

13 fsPromisesPromise = dynamicImport("node:fs/promises");

14 }

15 return fsPromisesPromise;

16}

17export function getNodeFsSync() {

18 if (typeof process === "undefined" || !(process.versions?.node || process.versions["bun"])) {

19 return null;

20 }

21 const builtinProcess = process;

22 if (typeof builtinProcess.getBuiltinModule !== "function") {

23 return null;

24 }

25 try {

26 const module = builtinProcess.getBuiltinModule("node:fs");

27 if (typeof module?.readFileSync !== "function")

28 return null;

dist/ui/settings/links.jsView file

Lines 1-15javascript

1import { spawn } from "node:child_process";

2export const GITHUB_URL = "https://github.com/IgorWarzocha/howaboua-pi-stuff/tree/main/packages/pi-codex-conversion";

3export const CHANGELOG_URL = `${GITHUB_URL}/CHANGELOG.md`;

4export const DISCORD_URL

src/tools/view-image/bin/win32-arm64/view_image.exeView file

•path = src/tools/view-image/bin/win32-arm64/view_image.exe kind = native_binary sizeBytes = 1199616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/tools/view-image/bin/win32-arm64/view_image.exeView on unpkg

bin/apply_patch.cmdView file

•path = bin/apply_patch.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/apply_patch.cmdView on unpkg

examples/custom-tools/spawn-agent/spawn-agent.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

examples/custom-tools/spawn-agent/spawn-agent.mjsView on unpkg