registry / @just-every/code / 0.6.136

@just-every/code@0.6.136

Lightweight coding agent that runs in your terminal - fork of OpenAI Codex

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 56.4 KB of source, external domains: github.com

Source & flagged code

7 flagged

package.jsonView file

Lines 2-43json

2 "name": "@just-every/code",

3 "version": "0.6.136",

4 "license": "Apache-2.0",

5 "description": "Lightweight coding agent that runs in your terminal - fork of OpenAI Codex",

6 "bin": {

7 "coder": "bin/coder.js"

8 },

9 "type": "module",

10 "engines": {

11 "node": ">=16"

12 },

13 "files": [

14 "bin/coder.js",

15 "bin/codex.js",

16 "postinstall.js",

17 "scripts/preinstall.js",

18 "scripts/windows-cleanup.ps1",

19 "dist"

20 ],

21 "scripts": {

22 "preinstall": "node scripts/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "prepublishOnly": "node -e \"const fs=require('fs'),path=require('path'); const repoGit=path.join(__dirname,'..','.git'); const inCi=process.env.GITHUB_ACTIONS==='true'||process.env.CI==='true'; if(fs.existsSync(repoGit) && !inCi){ console.error('Refusing to publish from codex-cli. Publishing happens via release.yml.'); process.exit(1);} else { console.log(inCi ? 'CI publish detected.' : 'Publishing staged package...'); }\""

25 },

26 "repository": {

27 "type": "git",

28 "url": "git+https://github.com/just-every/code.git"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "dependencies": {},

34 "devDependencies": {

35 "prettier": "^3.3.3"

36 },

37 "optionalDependencies": {

38 "@just-every/code-darwin-arm64": "0.6.136",

39 "@just-every/code-darwin-x64": "0.6.136",

40 "@just-every/code-linux-x64-musl": "0.6.136",

41 "@just-every/code-linux-arm64-musl": "0.6.136",

42 "@just-every/code-win32-x64": "0.6.136"

43 }

bin/coder.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Unified entry point for the Code CLI (fork of OpenAI Codex).

4import path from "path";

5import { fileURLToPath } from "url";

6import { platform as nodePlatform, arch as nodeArch } from "os";

7import { execSync } from

scripts/windows-cleanup.ps1View file

•path = scripts/windows-cleanup.ps1 kind = build_helper sizeBytes = 1180 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-cleanup.ps1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/coder.jsView file

6import { platform as nodePlatform, arch as nodeArch } from "os"; L7: import { execSync } from "child_process"; L8: import { get as httpsGet } from "https";

High

Child Process

Package source references child process execution.

bin/coder.jsView on unpkg · L6

High

Shell

Package source references shell execution.

bin/coder.jsView on unpkg · L222

222? `code-${targetTriple}.zip` L223: : (() => { try { execSync("zstd --version", { stdio: "ignore", shell: true }); return `code-${targetTriple}.zst`; } catch { return `code-${targetTriple}.tar.gz`; } })(); L224: const url = `https://github.com/just-every/code/releases/download/v${version}/${archiveName}`; L225: const tmp = path.join(binDir, `.${archiveName}.part`); ... L230: try { L231: const sysRoot = process.env.SystemRoot || process.env.windir || 'C:\\\Windows'; L232: const psFull = path.join(sysRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/coder.jsView on unpkg · L222

scripts/windows-cleanup.ps1View file

•path = scripts/windows-cleanup.ps1 kind = build_helper sizeBytes = 1180 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-cleanup.ps1View on unpkg

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/coder.js

HighShellbin/coder.js

HighSame File Env Network Executionbin/coder.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/windows-cleanup.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 2-43json

2 "name": "@just-every/code",

3 "version": "0.6.136",

4 "license": "Apache-2.0",

5 "description": "Lightweight coding agent that runs in your terminal - fork of OpenAI Codex",

6 "bin": {

7 "coder": "bin/coder.js"

8 },

9 "type": "module",

10 "engines": {

11 "node": ">=16"

12 },

13 "files": [

14 "bin/coder.js",

15 "bin/codex.js",

16 "postinstall.js",

17 "scripts/preinstall.js",

18 "scripts/windows-cleanup.ps1",

19 "dist"

20 ],

21 "scripts": {

22 "preinstall": "node scripts/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

25 },

26 "repository": {

27 "type": "git",

28 "url": "git+https://github.com/just-every/code.git"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "dependencies": {},

34 "devDependencies": {

35 "prettier": "^3.3.3"

36 },

37 "optionalDependencies": {

38 "@just-every/code-darwin-arm64": "0.6.136",

39 "@just-every/code-darwin-x64": "0.6.136",

40 "@just-every/code-linux-x64-musl": "0.6.136",

41 "@just-every/code-linux-arm64-musl": "0.6.136",

42 "@just-every/code-win32-x64": "0.6.136"

43 }

bin/coder.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Unified entry point for the Code CLI (fork of OpenAI Codex).

4import path from "path";

5import { fileURLToPath } from "url";

6import { platform as nodePlatform, arch as nodeArch } from "os";

7import { execSync } from

scripts/windows-cleanup.ps1View file

•path = scripts/windows-cleanup.ps1 kind = build_helper sizeBytes = 1180 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-cleanup.ps1View on unpkg

Lines 202-242javascript

202 try {

203 const pkgJson = req.resolve(`${name}/package.json`);

204 const pkgDir = path.dirname(pkgJson);

205 const src = path.join(pkgDir, "bin", `code-${targetTriple}`);

206 if (existsSync(src)) {

207 // Always ensure cache has the binary; on Unix mirror into node_modules

208 copyFileSync(src, cachePath);

209 if (platform !== "win32") {

210 copyFileSync(cachePath, binaryPath);

211 try { chmodSync(binaryPath, 0o755); } catch {}

212 }

213 return true;

214 }

215 } catch { /* ignore and fall back */ }

216 }

217 } catch { /* ignore */ }

218

219 // 4) Download from GitHub release

220 const isWin = platform === "win32";

221 const archiveName = isWin

222 ? `code-${targetTriple}.zip`

223 : (() => { try { execSync("zstd --version", { stdio: "ignore", shell: true }); return `code-${targetTriple}.zst`; } catch { return `code-${targetTriple}.tar.gz`; } })();

224 const url = `https://github.com/just-every/code/releases/download/v${version}/${archiveName}`;

High

Shell

Package source references shell execution.

bin/coder.jsView on unpkg · L222

225 const tmp = path.join(binDir, `.${archiveName}.part`);

226 return httpsDownload(url, tmp)

227 .then(() => {

228 if (isWin) {

229 // Extract zip with robust fallbacks and use a safe temp dir, then move to cache

230 try {

231 const sysRoot = process.env.SystemRoot || process.env.windir || 'C:\\\Windows';

232 const psFull = path.join(sysRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/coder.jsView on unpkg · L222

233 const unzipDest = getCacheDir(version); // extract directly to cache location

234 const psCmd = `Expand-Archive -Path '${tmp}' -DestinationPath '${unzipDest}' -Force`;

235 let ok = false;

236 try { execSync(`"${psFull}" -NoProfile -NonInteractive -Command "${psCmd}"`, { stdio: 'ignore' }); ok = true; } catch {}

237 if (!ok) { try { execSync(`powershell -NoProfile -NonInteractive -Command "${psCmd}"`, { stdio: 'ignore' }); ok = true; } catch {} }

238 if (!ok) { try { execSync(`pwsh -NoProfile -NonInteractive -Command "${psCmd}"`, { stdio: 'ignore' }); ok = true; } catch {} }

239 if (!ok) { execSync(`tar -xf "${tmp}" -C "${unzipDest}"`, { stdio: 'ignore', shell: true }); }

240 } catch (e) {

241 throw new Error(`failed to unzip: ${e.message}`);

242 } finally { try { unlinkSync(tmp); } catch {} }