registry / @jvittechs/j / 1.0.103

@jvittechs/j@1.0.103

A unified CLI tool for JV-IT TECHS developers to manage Jai1 Framework. Supports both `j` and `jai1` commands. Please contact TeamAI for usage instructions.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 1020 KB of source, external domains: api.example.com, example.com, github.com, nodejs.org, pypi.org, registry.npmjs.org, skills.sh, store.jai1.io

Source & flagged code

9 flagged

package.jsonView file

Lines 22-62json

22 "license": "MIT",

23 "author": "JVIT <dev@jvit.com>",

24 "repository": {

25 "type": "git",

26 "url": "git+https://github.com/jvittechs/jai.git",

27 "directory": "packages/cli"

28 },

29 "homepage": "https://github.com/jvittechs/jai/tree/main/packages/cli#readme",

30 "keywords": [

31 "jai1",

32 "framework",

33 "redmine",

34 "cli",

35 "markdown",

36 "issues",

37 "context",

38 "agentic",

39 "coding"

40 ],

41 "scripts": {

42 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "bundle:guide": "node scripts/bundle-guide-content.js",

44 "build": "npm run bundle:guide && tsup src/cli.ts --dts --format esm --target node22 --out-dir dist --sourcemap && npm run copy-web-chat",

45 "copy-web-chat": "mkdir -p dist/web-chat && cp -r src/web-chat/* dist/web-chat/",

46 "dev": "tsx src/cli.ts --help",

47 "lint": "eslint .",

48 "test": "vitest run",

49 "release": "node scripts/release.js",

50 "smart-publish": "node scripts/smart-publish.js"

51 },

52 "dependencies": {

53 "@inquirer/prompts": "^8.0.2",

54 "adm-zip": "^0.5.16",

55 "bcryptjs": "^2.4.3",

56 "boxen": "^8.0.1",

57 "chalk": "^5.6.2",

58 "cli-progress": "^3.12.0",

59 "cli-table3": "^0.6.5",

60 "clipboardy": "^4.0.0",

61 "commander": "^12.1.0",

62 "cronstrue": "^2.50.0",

dist/cli-main-4O67NASR.jsView file

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli-main-4O67NASR.jsView on unpkg · L10351

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli-main-4O67NASR.js

dist/cli-main-4O67NASR.jsView on unpkg · L10351

199cronstrue: "^2.50.0", L200: execa: "^9.6.1", L201: figlet: "^1.9.4",

High

Shell

Package source references shell execution.

dist/cli-main-4O67NASR.jsView on unpkg · L199

12396case "pnpm": L12397: devDepsCmd = `pnpm add -D ${pkgList}`; L12398: break; ... L12411: executeUpgrade(command) { L12412: execSync(command, { stdio: "inherit", env: { ...process.env, FORCE_COLOR: "1" } }); L12413: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-main-4O67NASR.js

dist/chunk-V2TO2ADY.jsView file

Lines 1-23javascript

1// src/services/settings.service.ts

2import { promises as fs, existsSync, readFileSync } from "fs";

3import { join } from "path";

4import { execSync } from "child_process";

5import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

scripts/redmine-sync-issue.shView file

•path = scripts/redmine-sync-issue.sh kind = build_helper sizeBytes = 1000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/redmine-sync-issue.shView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli-main-4O67NASR.jsView file

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli-main-4O67NASR.jsView on unpkg · L10351

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli-main-4O67NASR.js

dist/cli-main-4O67NASR.jsView on unpkg · L10351

199cronstrue: "^2.50.0", L200: execa: "^9.6.1", L201: figlet: "^1.9.4",

High

Shell

Package source references shell execution.

dist/cli-main-4O67NASR.jsView on unpkg · L199

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-main-4O67NASR.jsView on unpkg · L12396

49constructor() { L50: this.jai1Dir = join(homedir(), ".jai1"); L51: this.errorDir = join(this.jai1Dir, "errors"); ... L66: stack: err.stack, L67: exitCode: error instanceof Jai1Error ? error.exitCode : void 0, L68: details: context.details ... L91: const bytes = Buffer.byteLength(content, "utf-8"); L92: const entry = JSON.parse(content); L93: return { entry, bytes }; ... L136: L137: // package.json L138: var package_default = {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-main-4O67NASR.jsView on unpkg · L49

dist/chunk-V2TO2ADY.jsView file

3import { join } from "path"; L4: import { execSync } from "child_process"; L5: import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-V2TO2ADY.jsView on unpkg · L3

scripts/redmine-sync-issue.shView file

•path = scripts/redmine-sync-issue.sh kind = build_helper sizeBytes = 1000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/redmine-sync-issue.shView on unpkg

Findings

2 Critical4 High5 Medium6 Low

CriticalCritical Secretdist/cli-main-4O67NASR.js

CriticalSecret Patterndist/cli-main-4O67NASR.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-V2TO2ADY.js

HighShelldist/cli-main-4O67NASR.js

HighRuntime Package Installdist/cli-main-4O67NASR.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/redmine-sync-issue.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli-main-4O67NASR.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 22-62json

22 "license": "MIT",

23 "author": "JVIT <dev@jvit.com>",

24 "repository": {

25 "type": "git",

26 "url": "git+https://github.com/jvittechs/jai.git",

27 "directory": "packages/cli"

28 },

29 "homepage": "https://github.com/jvittechs/jai/tree/main/packages/cli#readme",

30 "keywords": [

31 "jai1",

32 "framework",

33 "redmine",

34 "cli",

35 "markdown",

36 "issues",

37 "context",

38 "agentic",

39 "coding"

40 ],

41 "scripts": {

42 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "bundle:guide": "node scripts/bundle-guide-content.js",

44 "build": "npm run bundle:guide && tsup src/cli.ts --dts --format esm --target node22 --out-dir dist --sourcemap && npm run copy-web-chat",

45 "copy-web-chat": "mkdir -p dist/web-chat && cp -r src/web-chat/* dist/web-chat/",

46 "dev": "tsx src/cli.ts --help",

47 "lint": "eslint .",

48 "test": "vitest run",

49 "release": "node scripts/release.js",

50 "smart-publish": "node scripts/smart-publish.js"

51 },

52 "dependencies": {

53 "@inquirer/prompts": "^8.0.2",

54 "adm-zip": "^0.5.16",

55 "bcryptjs": "^2.4.3",

56 "boxen": "^8.0.1",

57 "chalk": "^5.6.2",

58 "cli-progress": "^3.12.0",

59 "cli-table3": "^0.6.5",

60 "clipboardy": "^4.0.0",

61 "commander": "^12.1.0",

62 "cronstrue": "^2.50.0",

dist/cli-main-4O67NASR.jsView file

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli-main-4O67NASR.jsView on unpkg · L10351

10351patternName = supabase_service_key severity = critical line = 10351 matchedText = $ jai1 u...w5c"

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli-main-4O67NASR.js

dist/cli-main-4O67NASR.jsView on unpkg · L10351

199cronstrue: "^2.50.0", L200: execa: "^9.6.1", L201: figlet: "^1.9.4",

High

Shell

Package source references shell execution.

dist/cli-main-4O67NASR.jsView on unpkg · L199

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli-main-4O67NASR.js

dist/chunk-V2TO2ADY.jsView file

Lines 1-23javascript

1// src/services/settings.service.ts

2import { promises as fs, existsSync, readFileSync } from "fs";

3import { join } from "path";

4import { execSync } from "child_process";

5import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

scripts/redmine-sync-issue.shView file

•path = scripts/redmine-sync-issue.sh kind = build_helper sizeBytes = 1000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/redmine-sync-issue.shView on unpkg