registry  /  @inflexa-ai/inflexa  /  0.3.3

@inflexa-ai/inflexa@0.3.3

Local-first AI agent for reproducible biological data analysis

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 5.33 KB of source, external domains: github.com

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/inflexa.jsView file
8// on Windows. L9: const { spawnSync } = require("node:child_process"); L10: const fs = require("node:fs");
High
Child Process

Package source references child process execution.

bin/inflexa.jsView on unpkg · L8
36"--no-optional/--omit=optional/--ignore-scripts, or install the platform", L37: `package directly: npm install @inflexa-ai/inflexa-${process.platform}-${process.arch}`, L38: ].join("\n"), ... L42: L43: const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" }); L44: if (result.error) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/inflexa.jsView on unpkg · L36
8// on Windows. L9: const { spawnSync } = require("node:child_process"); L10: const fs = require("node:fs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/inflexa.jsView on unpkg · L8

Findings

3 High5 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/inflexa.js
HighRuntime Package Installbin/inflexa.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/inflexa.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings