registry / @kdrrr/overcast / 0.0.11

@kdrrr/overcast@0.0.11

⚠ Under review

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 3.54 MB of source, external domains: api.cloudglue.dev, example.com, mac.tailnet.ts.net, www.openstreetmap.org, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 53-93json

53 "access": "public"

54 },

55 "scripts": {

56 "build": "tsup && npm run build:web",

57 "build:web": "vite build --config web/chair/vite.config.ts && vite build --config web/situation/vite.config.ts",

58 "dev:web": "vite --config web/chair/vite.config.ts",

59 "dev:web:situation": "vite --config web/situation/vite.config.ts",

60 "typecheck": "tsc --noEmit && tsc -p web/chair --noEmit && tsc -p web/situation --noEmit",

61 "test": "node --test --import tsx test/unit/*.test.ts",

62 "test:e2e": "bash test/e2e/run.sh",

63 "test:e2e:live": "bash test/e2e/live/run.sh",

64 "build:bun": "npm run build:web && bun build --compile bin/overcast.ts --outfile dist/bin/overcast && node scripts/bun-sidecar.mjs",

65 "build:vscode": "npm --prefix vscode run build",

66 "typecheck:vscode": "npm --prefix vscode run typecheck",

67 "dev": "tsx bin/overcast.ts",

68 "sync-version": "node scripts/sync-version.mjs",

69 "pack:check": "node scripts/sync-version.mjs --check && node scripts/check-dist-fresh.mjs",

70 "version": "node scripts/sync-version.mjs && git add -A src/version.ts .claude-plugin/plugin.json .claude-plugin/marketplace.json vscode/package.json vscode/package-lock.json",

71 "prepack": "npm run pack:check",

72 "prepublishOnly": "npm run build",

73 "postinstall": "node scripts/brand-pi.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

74 "brand": "node scripts/brand-pi.mjs"

75 },

76 "dependencies": {

77 "@earendil-works/pi-agent-core": "0.80.3",

78 "@earendil-works/pi-ai": "0.80.3",

79 "@earendil-works/pi-coding-agent": "0.80.3",

80 "@earendil-works/pi-tui": "0.80.3",

81 "zod": "^4.4.3"

82 },

83 "devDependencies": {

84 "@types/node": "^26.1.1",

85 "tsup": "^8.3.5",

86 "tsx": "^4.19.2",

87 "typescript": "^7.0.2",

88 "vite": "^8.1.3"

89 },

90 "optionalDependencies": {

91 "playwright": "^1.61.1"

92 }

93}

dist/extension/overcast.jsView file

220// src/providers/exec.ts L221: import { spawn } from "child_process"; L222: import { StringDecoder } from "string_decoder";

High

Child Process

Package source references child process execution.

dist/extension/overcast.jsView on unpkg · L220

80Cross-file remote execution chain: dist/extension/overcast.js spawns dist/bin/overcast.js; helper contains network access plus dynamic code execution. L80: if (typeof v === "string") { L81: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(v) && VISUAL_KEY_RE.test(key)) refs.add(v); L82: return; ... L179: try { L180: out.push(JSON.parse(t)); L181: } catch { ... L212: function envPresent(name) { L213: return typeof process.env[name] === "string" && process.env[name] !== ""; L214: } ... L220: // src/providers/exec.ts L221: import { spawn } from "child_process"; L222: import { StringDecoder } from "string_decoder";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extension/overcast.jsView on unpkg · L80

80if (typeof v === "string") { L81: if (/^data:image\//i.test(v) || VISUAL_EXT_RE.test(v) && VISUAL_KEY_RE.test(key)) refs.add(v); L82: return; ... L179: try { L180: out.push(JSON.parse(t)); L181: } catch { ... L212: function envPresent(name) { L213: return typeof process.env[name] === "string" && process.env[name] !== ""; L214: } ... L220: // src/providers/exec.ts L221: import { spawn } from "child_process"; L222: import { StringDecoder } from "string_decoder";

Low

examples/providers/sources/mcp-bridge.tsView file

Lines 1-79typescript

1#!/usr/bin/env -S npx tsx

2// overcast source provider: MCP consume bridge (prototype / worked example).

3//

4// Drives ANY stdio MCP server as an overcast source, speaking the exec source

5// contract (argv op -> JSON on stdout) with ZERO overcast core changes — the

6// canonical example of plugging an MCP feed in without touching `src/`. Bind it

7// like any custom source (see the filesystem-server recipe in docs/providers.md):

8//

9// export MCP_SERVER_CMD='npx -y @modelcontextprotocol/server-filesystem /data'

providers/engines/screenshot/screenshot.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 2719 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

providers/engines/screenshot/screenshot.shView on unpkg

assets/branding/sting.m4aView file

•path = assets/branding/sting.m4a kind = high_entropy_blob sizeBytes = 83043 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/branding/sting.m4aView on unpkg

dist/bin/overcast.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kdrrr/overcast@0.0.10 matchedIdentity = npm:QGtkcnJyL292ZXJjYXN0:0.0.10 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/overcast.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/brand-pi.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/extension/overcast.jsView file

220// src/providers/exec.ts L221: import { spawn } from "child_process"; L222: import { StringDecoder } from "string_decoder";

High

Child Process

Package source references child process execution.

dist/extension/overcast.jsView on unpkg · L220

Findings

1 Critical7 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/bin/overcast.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/extension/overcast.js

HighShellexamples/providers/sources/mcp-bridge.ts

HighCommand Output Exfiltrationexamples/providers/sources/mcp-bridge.ts

HighCloud Metadata Accessexamples/providers/sources/mcp-bridge.ts

HighCross File Remote Execution Contextdist/extension/overcast.js

HighShips High Entropy Blobassets/branding/sting.m4a

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperproviders/engines/screenshot/screenshot.sh

Medium