registry / @jokerized/getresearchdone / 0.4.9

@jokerized/getresearchdone@0.4.9

Get Research Done — R&D workflow automation for Claude Code

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 336 file(s), 4.47 MB of source, external domains: 127.0.0.1, api.openai.com, api.semanticscholar.org, arxiv.org, bun.sh, export.arxiv.org

Source & flagged code

7 flagged

package.jsonView file

Lines 27-67json

27 "mcp",

28 "cli"

29 ],

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/cameleon-x/grd"

33 },

34 "scripts": {

35 "test": "jest --coverage",

36 "test:unit": "jest tests/unit/ --coverage",

37 "test:integration": "jest tests/integration/",

38 "test:watch": "jest --watch",

39 "lint": "eslint bin/ lib/",

40 "lint:fix": "eslint --fix bin/ lib/",

41 "format": "prettier --write bin/ lib/ tests/ jest.config.js",

42 "format:check": "prettier --check bin/ lib/ tests/ jest.config.js",

43 "build": "tsc -p tsconfig.build.json",

44 "build:check": "tsc --noEmit",

45 "prepublishOnly": "npm run build",

46 "prepack": "node scripts/strip-pycache.mjs",

47 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "scan": "gd scan",

49 "scan:all": "gd scan --all",

50 "hooks:install": "node scripts/install-hooks.mjs"

51 },

52 "devDependencies": {

53 "@eslint/js": "^10.0.1",

54 "@types/jest": "^30.0.0",

55 "@typescript-eslint/eslint-plugin": "^8.56.1",

56 "@typescript-eslint/parser": "^8.56.1",

57 "eslint": "^10.0.0",

58 "globals": "^17.3.0",

59 "jest": "^30.2.0",

60 "prettier": "^3.8.1",

61 "ts-jest": "^29.4.6",

62 "typescript": "^5.9.3",

63 "typescript-eslint": "^8.56.1"

64 },

65 "dependencies": {

66 "@mozilla/readability": "^0.6.0",

67 "jsdom": "^29.1.1",

dist/lib/research/runner.jsView file

Lines 1-25javascript

1'use strict';

2Object.defineProperty(exports, "__esModule", { value: true });

3const path = require('path');

4// execFileSync only (NOT exec): no shell is spawned and args are passed as an array,

5// so the generated script path cannot inject shell commands.

6const { execFileSync } =

bin/grd-mcp-server.tsView file

Lines 25-65typescript

25/** JSON-RPC 2.0 response written to stdout */

26interface JsonRpcResponse {

27 jsonrpc: '2.0';

28 id: number | string | null;

29 result?: unknown;

dist/lib/research/fetch.jsView file

Lines 121-161javascript

121 clearTimeout(timer);

122 }

123 if (resp.status >= 300 && resp.status < 400) {

124 const loc = resp.headers.get('location');

125 if (

dist/lib/autoresearch.js#virtual:normalized:round1View file

106case 'test_count': { L107: const result = child_process.spawnSync('npx', ['jest', '--json', '--silent'], { L108: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/autoresearch.js#virtual:normalized:round1View on unpkg · L106

bin/harness_driver.pyView file

•path = bin/harness_driver.py kind = build_helper sizeBytes = 37140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/harness_driver.pyView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib/research/runner.jsView file

5// so the generated script path cannot inject shell commands. L6: const { execFileSync } = require('child_process'); L7: function parseMetricsLine(stdout) {

High

Child Process

Package source references child process execution.

dist/lib/research/runner.jsView on unpkg · L5

bin/grd-mcp-server.tsView file

45McpServer: McpServerConstructor; L46: } = require('../lib/mcp-server'); L47:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/grd-mcp-server.tsView on unpkg · L45

dist/lib/research/fetch.jsView file

141const { resp, finalUrl, maxBytes } = await httpResolve(url, opts); L142: const body = await resp.text(); L143: if (body.length > maxBytes) ... L189: '', L190: `_Source: https://arxiv.org/abs/${id}_`, L191: '', ... L239: async function fetchSource(cwd, input, opts = {}) { L240: const d = detectSource(cwd, input, { pdfBody: opts.pdfBody }); L241: if (d.kind === 'local')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/research/fetch.jsView on unpkg · L141

dist/lib/autoresearch.js#virtual:normalized:round1View file

106case 'test_count': { L107: const result = child_process.spawnSync('npx', ['jest', '--json', '--silent'], { L108: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/autoresearch.js#virtual:normalized:round1View on unpkg · L106

bin/harness_driver.pyView file

•path = bin/harness_driver.py kind = build_helper sizeBytes = 37140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/harness_driver.pyView on unpkg

Findings

4 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/lib/research/runner.js

HighShell

HighRuntime Package Installdist/lib/autoresearch.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/grd-mcp-server.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/harness_driver.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/lib/research/fetch.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

package.jsonView file

Lines 27-67json

27 "mcp",

28 "cli"

29 ],

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/cameleon-x/grd"

33 },

34 "scripts": {

35 "test": "jest --coverage",

36 "test:unit": "jest tests/unit/ --coverage",

37 "test:integration": "jest tests/integration/",

38 "test:watch": "jest --watch",

39 "lint": "eslint bin/ lib/",

40 "lint:fix": "eslint --fix bin/ lib/",

41 "format": "prettier --write bin/ lib/ tests/ jest.config.js",

42 "format:check": "prettier --check bin/ lib/ tests/ jest.config.js",

43 "build": "tsc -p tsconfig.build.json",

44 "build:check": "tsc --noEmit",

45 "prepublishOnly": "npm run build",

46 "prepack": "node scripts/strip-pycache.mjs",

47 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "scan": "gd scan",

49 "scan:all": "gd scan --all",

50 "hooks:install": "node scripts/install-hooks.mjs"

51 },

52 "devDependencies": {

53 "@eslint/js": "^10.0.1",

54 "@types/jest": "^30.0.0",

55 "@typescript-eslint/eslint-plugin": "^8.56.1",

56 "@typescript-eslint/parser": "^8.56.1",

57 "eslint": "^10.0.0",

58 "globals": "^17.3.0",

59 "jest": "^30.2.0",

60 "prettier": "^3.8.1",

61 "ts-jest": "^29.4.6",

62 "typescript": "^5.9.3",

63 "typescript-eslint": "^8.56.1"

64 },

65 "dependencies": {

66 "@mozilla/readability": "^0.6.0",

67 "jsdom": "^29.1.1",

dist/lib/research/runner.jsView file

Lines 1-25javascript

1'use strict';

2Object.defineProperty(exports, "__esModule", { value: true });

3const path = require('path');

4// execFileSync only (NOT exec): no shell is spawned and args are passed as an array,

5// so the generated script path cannot inject shell commands.

6const { execFileSync } =

bin/grd-mcp-server.tsView file

Lines 25-65typescript

25/** JSON-RPC 2.0 response written to stdout */

26interface JsonRpcResponse {

27 jsonrpc: '2.0';

28 id: number | string | null;

29 result?: unknown;

dist/lib/research/fetch.jsView file

Lines 121-161javascript

121 clearTimeout(timer);

122 }

123 if (resp.status >= 300 && resp.status < 400) {

124 const loc = resp.headers.get('location');

125 if (

dist/lib/autoresearch.js#virtual:normalized:round1View file

106case 'test_count': { L107: const result = child_process.spawnSync('npx', ['jest', '--json', '--silent'], { L108: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/autoresearch.js#virtual:normalized:round1View on unpkg · L106

bin/harness_driver.pyView file

•path = bin/harness_driver.py kind = build_helper sizeBytes = 37140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/harness_driver.pyView on unpkg