registry / @inflexa-ai/inflexa / 0.3.3

@inflexa-ai/inflexa@0.3.3

Local-first AI agent for reproducible biological data analysis

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.33 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 3-36json

3 "version": "0.3.3",

4 "description": "Local-first AI agent for reproducible biological data analysis",

5 "license": "Apache-2.0",

6 "homepage": "https://github.com/inflexa-ai/inflexa",

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/inflexa.jsView file

8// on Windows. L9: const { spawnSync } = require("node:child_process"); L10: const fs = require("node:fs");

High

Child Process

Package source references child process execution.

bin/inflexa.jsView on unpkg · L8

36"--no-optional/--omit=optional/--ignore-scripts, or install the platform", L37: `package directly: npm install @inflexa-ai/inflexa-${process.platform}-${process.arch}`, L38: ].join("\n"), ... L42: L43: const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" }); L44: if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/inflexa.jsView on unpkg · L36

8// on Windows. L9: const { spawnSync } = require("node:child_process"); L10: const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/inflexa.jsView on unpkg · L8

Findings

3 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/inflexa.js

HighRuntime Package Installbin/inflexa.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/inflexa.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

bin/inflexa.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2"use strict";

3// The @inflexa-ai/inflexa `bin`: resolves and executes the platform-native

4// binary delivered by one of the @inflexa-ai/inflexa-<platform>-<arch>

5// optionalDependencies, falling back to the copy postinstall.js downloaded

6// when optional dependencies were skipped. The `bin` stays a Node script —

7// pointing it at the raw executable breaks the shims npm/pnpm/bun generate

8// on Windows.

9const { spawnSync } = require("node:child_process");

10const fs = require("node:fs");

High

Child Process

Package source references child process execution.

bin/inflexa.jsView on unpkg · L8

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/inflexa.jsView on unpkg · L8

11const path = require("node:path");

13function resolveBinary() {

14 if (process.env.INFLEXA_BIN_PATH) return process.env.INFLEXA_BIN_PATH;

15 const binName = process.platform === "win32" ? "inflexa.exe" : "inflexa";

16 // TODO(extend): pick a -musl platform package on musl libc once those

17 // binaries ship (inflexa-ai/inflexa#107).

18 const pkg = `@inflexa-ai/inflexa-${process.platform}-${process.arch}`;

19 try {

20 const pkgJson = require.resolve(`${pkg}/package.json`);

21 return path.join(path.dirname(pkgJson), "bin", binName);

22 } catch {

23 const fallback = path.join(__dirname, "..", "bin-fallback", binName);

24 if (fs.existsSync(fallback)) return fallback;

25 return null;

26 }

27}

29const bin = resolveBinary();

30if (!bin) {

31 console.error(

32 [

33 `inflexa: no binary available for ${process.platform}-${process.arch}.`,

34 "The platform package (an optionalDependency) was not installed, and the",

35 "postinstall fallback did not deliver a binary either. Reinstall without",

36 "--no-optional/--omit=optional/--ignore-scripts, or install the platform",

37 `package directly: npm install @inflexa-ai/inflexa-${process.platform}-${process.arch}`,

38 ].join("\n"),

39 );

40 process.exit(1);

41}

43const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

44if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/inflexa.jsView on unpkg · L36

45 console.error(`inflexa: failed to start ${bin}: ${result.error.message}`);

46 process.exit(1);

47}

48process.exit(typeof result.status === "number" ? result.status : 0);