registry / @innocarpe/deepseek-build / 2.0.1

@innocarpe/deepseek-build@2.0.1

DeepSeek Build 2.0.1 — Grok-class agent with DeepSeek UI (whale + #4D6BFE). CLI: deepseek-build, dsb.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 64.5 KB of source, external domains: rustup.rs

Source & flagged code

5 flagged

package.jsonView file

Lines 21-52json

21 "bin": {

22 "deepseek-build": "npm/bin/deepseek-build.js",

23 "dsb": "npm/bin/dsb.js"

24 },

25 "files": [

26 "npm/**",

27 "scripts/install.sh",

28 "scripts/check-semver.sh",

29 "crates/**",

30 "Cargo.toml",

31 "Cargo.lock",

32 "rust-toolchain.toml",

33 "README.md",

34 "LICENSE",

35 "NOTICE",

36 "third_party/grok-build/**",

37 "docs/architecture/GROK_VENDOR.md",

38 "scripts/build-grok-pager.sh"

39 ],

40 "scripts": {

41 "postinstall": "node npm/scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "version-check": "node npm/scripts/check-version-match.js",

43 "prepublishOnly": "node npm/scripts/check-version-match.js && ./scripts/check-semver.sh"

44 },

45 "publishConfig": {

46 "access": "public"

47 },

48 "engines": {

49 "node": ">=18"

50 }

51}

third_party/grok-build/crates/codegen/xai-grok-pager/scripts/install-enterprise.ps1View file

•path = third_party/grok-build/crates/codegen/xai-grok-pager/scripts/install-enterprise.ps1 kind = build_helper sizeBytes = 12460 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

third_party/grok-build/crates/codegen/xai-grok-pager/scripts/install-enterprise.ps1View on unpkg

third_party/grok-build/crates/codegen/xai-grok-shell/tests/memory_integration/run_tests.pyView file

•path = third_party/grok-build/crates/codegen/xai-grok-shell/tests/memory_integration/run_tests.py kind = payload_in_excluded_dir sizeBytes = 95242 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

third_party/grok-build/crates/codegen/xai-grok-shell/tests/memory_integration/run_tests.pyView on unpkg

third_party/grok-build/crates/codegen/xai-grok-pager/npm/grok/bin/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @innocarpe/deepseek-build@5.5.3 matchedIdentity = npm:[redacted]:5.5.3 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

third_party/grok-build/crates/codegen/xai-grok-pager/npm/grok/bin/postinstall.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/scripts/postinstall.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code