registry / @icxcoffee/chorus / 0.1.3

@icxcoffee/chorus@0.1.3

Pi extension that fans a prompt out to multiple LLM voices in parallel, then asks a distinct conductor model to synthesize the successful responses.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 193 KB of source

Source & flagged code

1 flagged

dist/providers/adapters.jsView file

Lines 13-53javascript

13}

14/**

15 * Rejects non-https endpoints and link-local / cloud-metadata IPs before any

16 * credentials are attached. Localhost (loopback) is permitted over plain http

17 * for development. Throws on unsafe endpoints.

18 */

19export function assertSafeEndpoint(endpoint) {

20 let url;

Source & flagged code

1 flagged · loading source

dist/providers/adapters.jsView file

33if (url.protocol !== "https:" && !isLoopback) { L34: throw new Error(`chorus refuses non-https model endpoint ${url.protocol}//${host}; use https:// or localhost for local debugging`); L35: } ... L103: signal, L104: body: JSON.stringify({ L105: model: resolved.ref.modelId,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/providers/adapters.jsView on unpkg · L33

Findings

1 High2 Medium4 Low

HighCloud Metadata Accessdist/providers/adapters.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings