registry / @ibrahimalsharif/vibe-test / 0.1.5

@ibrahimalsharif/vibe-test@0.1.5

Public bootstrap installer for the private @ibrahimalsharif/vibe-test GitHub Packages package

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 5.21 KB of source, external domains: npm.pkg.github.com

Source & flagged code

1 flagged

bin/vibe-test.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { execFileSync, spawnSync } = require("child_process");

6const SCOPE = "@ibrahimalsharif";

7const REGISTRY = "https://npm.pkg.github.com";

8// The private installer is published to GitHub Packages with the `latest` tag

9// (the real installer, NOT this bootstrap). We exec its `vibe-test-install` bin —

10// a name only the private package provides — so npm must fetch the private

11// package to satisfy the command and cannot re-resolve back to this bootstrap.

12const PRIVATE_PACKAGE = "@ibrahimalsharif/vibe-test@latest";

14// Re-entry guard. The public bootstrap and the private installer share the

15// scoped name `@ibrahimalsharif/vibe-test` across two registries (npmjs and

16// GitHub Packages). If a misconfigured registry/tag ever resolves the private

17// fetch back to THIS bootstrap, the install would loop forever (the symptom that

18// motivated this guard). The guard makes the second entry abort loudly instead.

19const REENTRY_ENV = "VIBE_TEST_BOOTSTRAP_ACTIVE";

21function print(message = "") {

22 process.stdout.write(`${message}\n`);

23}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vibe-test.jsView on unpkg · L3

Source & flagged code

1 flagged · loading source

bin/vibe-test.jsView file

3L4: const { execFileSync, spawnSync } = require("child_process"); L5: L6: const SCOPE = "@ibrahimalsharif"; L7: const REGISTRY = "https://npm[redacted]"; L8: // The private installer is published to GitHub Packages with the `latest` tag L9: // (the real installer, NOT this bootstrap). We exec its `vibe-test-install` bin — ... L21: function print(message = "") { L22: process.stdout.write(`${message}\n`); L23: } ... L27: stdio: options.stdio || "inherit", L28: shell: process.platform === "win32",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vibe-test.jsView on unpkg · L3

Findings

1 High1 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/vibe-test.js

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

LowNo License