registry / @intellicore/cli / 0.4.0

@intellicore/cli@0.4.0

IntelliCore CLI — agentflow를 터미널에서 실행하는 AI 개발 도구

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 326 KB of source, external domains: get.docker.com, github.com, sh.rustup.rs

Source & flagged code

3 flagged

dist/chunk-CH3QJX6G.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/shared/utils/system-context.ts

4import { execSync } from "child_process";

5import { platform, arch } from "os";

High

Child Process

Package source references child process execution.

dist/chunk-CH3QJX6G.jsView on unpkg · L3

6var cached = null;

7function collectSystemContext() {

8 if (cached) return cached;

9 const runtimes = {};

10 const buildTools = {};

11 const constraints = [];

12 runtimes.java = getVersion("java --version", /(?:openjdk|java)\s+(\d+[\d.]*)/i);

13 runtimes.node = getVersion("node --version", /v?([\d.]+)/);

14 runtimes.python = getVersion("python3 --version", /([\d.]+)/);

15 runtimes.go = getVersion("go version", /go([\d.]+)/);

16 runtimes.rust = getVersion("rustc --version", /([\d.]+)/);

17 for (const [k, v] of Object.entries(runtimes)) {

18 if (!v) delete runtimes[k];

19 }

20 buildTools.maven = commandExists("mvn");

21 buildTools.gradle = commandExists("gradle");

22 buildTools.npm = commandExists("npm");

23 buildTools.yarn = commandExists("yarn");

dist/knowledge-VZYH555V.jsView file

Lines 60-100javascript

60 if (tokens > MAX_CHUNK_TOKENS) {

61 chunks.push(...splitChunk(path, lines, start, end));

62 } else {

63 chunks.push({

64 id: createHash("md5").update(`${path}:${start}`).

dist/update-5MGTB2UK.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import "./chunk-7OCVIDC7.js";

4// src/features/update/update.ts

5import { execSync } from "child_process";

6import chalk from "chalk";

7async function updateCommand() {

8 console.

Source & flagged code

3 flagged · loading source

dist/chunk-CH3QJX6G.jsView file

3// src/shared/utils/system-context.ts L4: import { execSync } from "child_process"; L5: import { platform, arch } from "os";

High

Child Process

Package source references child process execution.

dist/chunk-CH3QJX6G.jsView on unpkg · L3

dist/knowledge-VZYH555V.jsView file

80/^(?:export\s+)?const\s+\w+\s*=\s*(?:async\s*)?\(/, L81: /^(?:public|private|protected)\s+(?:static\s+)?(?:async\s+)?\w+\s*\(/, L82: /^def\s+\w+/, ... L176: try { L177: const data = JSON.parse(readFileSync(storePath, "utf-8")); L178: this.chunks = data.chunks;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/knowledge-VZYH555V.jsView on unpkg · L80

dist/update-5MGTB2UK.jsView file

19console.log(chalk.blue(" \u280B \uC5C5\uB370\uC774\uD2B8 \uC911...")); L20: execSync("npm install -g @intellicore/cli@latest", { L21: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update-5MGTB2UK.jsView on unpkg · L19

Findings

3 High3 Medium6 Low

HighChild Processdist/chunk-CH3QJX6G.js

HighShell

HighRuntime Package Installdist/update-5MGTB2UK.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/knowledge-VZYH555V.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunk-CH3QJX6G.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/shared/utils/system-context.ts

4import { execSync } from "child_process";

5import { platform, arch } from "os";

High

Child Process

Package source references child process execution.

dist/chunk-CH3QJX6G.jsView on unpkg · L3

6var cached = null;

7function collectSystemContext() {

8 if (cached) return cached;

9 const runtimes = {};

10 const buildTools = {};

11 const constraints = [];

12 runtimes.java = getVersion("java --version", /(?:openjdk|java)\s+(\d+[\d.]*)/i);

13 runtimes.node = getVersion("node --version", /v?([\d.]+)/);

14 runtimes.python = getVersion("python3 --version", /([\d.]+)/);

15 runtimes.go = getVersion("go version", /go([\d.]+)/);

16 runtimes.rust = getVersion("rustc --version", /([\d.]+)/);

17 for (const [k, v] of Object.entries(runtimes)) {

18 if (!v) delete runtimes[k];

19 }

20 buildTools.maven = commandExists("mvn");

21 buildTools.gradle = commandExists("gradle");

22 buildTools.npm = commandExists("npm");

23 buildTools.yarn = commandExists("yarn");

dist/knowledge-VZYH555V.jsView file

Lines 60-100javascript

60 if (tokens > MAX_CHUNK_TOKENS) {

61 chunks.push(...splitChunk(path, lines, start, end));

62 } else {

63 chunks.push({

64 id: createHash("md5").update(`${path}:${start}`).

dist/update-5MGTB2UK.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import "./chunk-7OCVIDC7.js";

4// src/features/update/update.ts

5import { execSync } from "child_process";

6import chalk from "chalk";

7async function updateCommand() {

8 console.