registry / @ibrahimalsharif/vibe-test / 0.1.1

@ibrahimalsharif/vibe-test@0.1.1

Public bootstrap installer for the private @ibrahimalsharif/vibe-test GitHub Packages package

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 3.66 KB of source, external domains: npm.pkg.github.com

Source & flagged code

1 flagged

bin/vibe-test.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { execFileSync, spawnSync } = require("child_process");

6const SCOPE = "@ibrahimalsharif";

7const REGISTRY = "https://npm.pkg.github.com";

8// CI publishes the private package under the `main` dist-tag (publish-to-npm.yml

9// uses `npm publish --tag main` with a `-main.<sha>` prerelease version); the

10// `latest` tag is never set, so `@latest` would not resolve. Track `@main`.

11const PRIVATE_PACKAGE = "@ibrahimalsharif/vibe-test@main";

13function print(message = "") {

14 process.stdout.write(`${message}\n`);

15}

17function runNpm(args, options = {}) {

18 return spawnSync("npm", args, {

19 stdio: options.stdio || "inherit",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vibe-test.jsView on unpkg · L3

20 shell: process.platform === "win32",

21 env: process.env

22 });

23}

Source & flagged code

1 flagged · loading source

bin/vibe-test.jsView file

3L4: const { execFileSync, spawnSync } = require("child_process"); L5: L6: const SCOPE = "@ibrahimalsharif"; L7: const REGISTRY = "https://npm[redacted]"; L8: // CI publishes the private package under the `main` dist-tag (publish-to-npm.yml L9: // uses `npm publish --tag main` with a `-main.<sha>` prerelease version); the L10: // `latest` tag is never set, so `@latest` would not resolve. Track `@main`. ... L13: function print(message = "") { L14: process.stdout.write(`${message}\n`); L15: } ... L19: stdio: options.stdio || "inherit",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vibe-test.jsView on unpkg · L3

Findings

1 High1 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/vibe-test.js

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

bin/vibe-test.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { execFileSync, spawnSync } = require("child_process");

6const SCOPE = "@ibrahimalsharif";

7const REGISTRY = "https://npm.pkg.github.com";

8// CI publishes the private package under the `main` dist-tag (publish-to-npm.yml

9// uses `npm publish --tag main` with a `-main.<sha>` prerelease version); the

10// `latest` tag is never set, so `@latest` would not resolve. Track `@main`.

11const PRIVATE_PACKAGE = "@ibrahimalsharif/vibe-test@main";

13function print(message = "") {

14 process.stdout.write(`${message}\n`);

15}

17function runNpm(args, options = {}) {

18 return spawnSync("npm", args, {

19 stdio: options.stdio || "inherit",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vibe-test.jsView on unpkg · L3

20 shell: process.platform === "win32",

21 env: process.env

22 });

23}