registry / @howaboua/pi-codex-conversion / 2.2.12

@howaboua/pi-codex-conversion@2.2.12

Codex-oriented tool and prompt adapter for pi coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 257 file(s), 1.39 MB of source, external domains: api.openai.com, auth.openai.com, chatgpt.com, discord.com, github.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/providers/openai-codex/node-runtime.jsView file

Lines 1-28javascript

1var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {

2 if (typeof path === "string" && /^\.\.?\//.test(path)) {

3 return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx

4 return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase

5 });

6 }

7 return path;

8};

9const dynamicImport = (specifier) => import(__rewriteRelativeImportExtension(specifier));

10let fsPromisesPromise;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/openai-codex/node-runtime.jsView on unpkg · L8

11export async function getNodeFsPromises() {

12 if (!fsPromisesPromise) {

13 fsPromisesPromise = dynamicImport("node:fs/promises");

14 }

15 return fsPromisesPromise;

16}

17export function getNodeFsSync() {

18 if (typeof process === "undefined" || !(process.versions?.node || process.versions["bun"])) {

19 return null;

20 }

21 const builtinProcess = process;

22 if (typeof builtinProcess.getBuiltinModule !== "function") {

23 return null;

24 }

25 try {

26 const module = builtinProcess.getBuiltinModule("node:fs");

27 if (typeof module?.readFileSync !== "function")

28 return null;

dist/ui/settings/links.jsView file

Lines 1-15javascript

1import { spawn } from "node:child_process";

2export const GITHUB_URL = "https://github.com/IgorWarzocha/howaboua-pi-stuff/tree/main/packages/pi-codex-conversion";

3export const CHANGELOG_URL = `${

src/tools/view-image/bin/win32-arm64/view_image.exeView file

•path = src/tools/view-image/bin/win32-arm64/view_image.exe kind = native_binary sizeBytes = 1199616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/tools/view-image/bin/win32-arm64/view_image.exeView on unpkg

bin/apply_patch.cmdView file

•path = bin/apply_patch.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/apply_patch.cmdView on unpkg

dist/adapter/compaction/compaction.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @howaboua/pi-codex-conversion@2.2.11 matchedIdentity = npm:[redacted]:2.2.11 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapter/compaction/compaction.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/providers/openai-codex/node-runtime.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code