registry / @jmylchreest/aide-plugin / 0.1.4

@jmylchreest/aide-plugin@0.1.4

aide plugin for OpenCode and Codex CLI — multi-agent orchestration, memory, skills, and persistence

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 446 KB of source, external domains: api.anthropic.com, api.github.com, github.com, opencode.ai

Source & flagged code

2 flagged

bin/aide-wrapper.tsView file

Lines 1-38typescript

1#!/usr/bin/env bun

2/**

3 * aide-wrapper.ts - Ensures aide binary exists before executing

4 *

5 * Called by an assistant's MCP server configuration.

6 * Finds the aide binary, downloads it if missing, then delegates to it.

7 *

8 * Plugin root resolution order:

9 * 1. AIDE_PLUGIN_ROOT (canonical, platform-agnostic)

10 * 2. CLAUDE_PLUGIN_ROOT (set by Claude Code)

11 * 3. SCRIPT_DIR/.. (fallback: infer from wrapper location)

12 *

13 * Lives at: <plugin-root>/bin/aide-wrapper.ts

14 * Binary at: <plugin-root>/bin/aide[.exe]

15 *

16 * Logs written to: .aide/_logs/wrapper.log

17 */

19import { execFileSync, spawnSync } from "child_process";

20import {

High

Child Process

Package source references child process execution.

bin/aide-wrapper.tsView on unpkg · L18

21 existsSync,

22 mkdirSync,

23 readFileSync,

24 realpathSync,

25 appendFileSync,

26 unlinkSync,

27 writeFileSync,

28 rmdirSync,

29} from "fs";

30import { dirname, join, resolve } from "path";

31import { fileURLToPath } from "url";

33const isWindows = process.platform === "win32";

34const EXT = isWindows ? ".exe" : "";

36// Resolve symlinks so that invoking via node_modules/.bin/aide-wrapper

37// (which is a symlink to the real package) gives us the real package dir.

38const __filename = fileURLToPath(import.meta.url);

Lines 260-300typescript

260 }

261

262 if (!existsSync(BINARY)) {

263 log("ERROR: Binary not found after download");

264 process.exit(1);

265 }

266 } finally {

267 releaseLock();

268 }

269

Source & flagged code

2 flagged · loading source

bin/aide-wrapper.tsView file

18L19: import { execFileSync, spawnSync } from "child_process"; L20: import {

High

Child Process

Package source references child process execution.

bin/aide-wrapper.tsView on unpkg · L18

280if (!existsSync(nodeModules)) { L281: log("node_modules missing — running bun install to restore dependencies"); L282: try { L283: const result = spawnSync("bun", ["install", "--frozen-lockfile"], { L284: cwd: PLUGIN_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/aide-wrapper.tsView on unpkg · L280

Findings

3 High3 Medium5 Low

HighChild Processbin/aide-wrapper.ts

HighShell

HighRuntime Package Installbin/aide-wrapper.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/aide-wrapper.tsView file

Lines 1-38typescript

1#!/usr/bin/env bun

2/**

3 * aide-wrapper.ts - Ensures aide binary exists before executing

4 *

5 * Called by an assistant's MCP server configuration.

6 * Finds the aide binary, downloads it if missing, then delegates to it.

7 *

8 * Plugin root resolution order:

9 * 1. AIDE_PLUGIN_ROOT (canonical, platform-agnostic)

10 * 2. CLAUDE_PLUGIN_ROOT (set by Claude Code)

11 * 3. SCRIPT_DIR/.. (fallback: infer from wrapper location)

12 *

13 * Lives at: <plugin-root>/bin/aide-wrapper.ts

14 * Binary at: <plugin-root>/bin/aide[.exe]

15 *

16 * Logs written to: .aide/_logs/wrapper.log

17 */

19import { execFileSync, spawnSync } from "child_process";

20import {

High

Child Process

Package source references child process execution.

bin/aide-wrapper.tsView on unpkg · L18

21 existsSync,

22 mkdirSync,

23 readFileSync,

24 realpathSync,

25 appendFileSync,

26 unlinkSync,

27 writeFileSync,

28 rmdirSync,

29} from "fs";

30import { dirname, join, resolve } from "path";

31import { fileURLToPath } from "url";

33const isWindows = process.platform === "win32";

34const EXT = isWindows ? ".exe" : "";

36// Resolve symlinks so that invoking via node_modules/.bin/aide-wrapper

37// (which is a symlink to the real package) gives us the real package dir.

38const __filename = fileURLToPath(import.meta.url);

Lines 260-300typescript

260 }

261

262 if (!existsSync(BINARY)) {

263 log("ERROR: Binary not found after download");

264 process.exit(1);

265 }

266 } finally {

267 releaseLock();

268 }

269