registry / @kenkaiiii/ggcoder / 5.6.2

@kenkaiiii/ggcoder@5.6.2

⚠ Under review

CLI coding agent with OAuth authentication for Anthropic, OpenAI, and Gemini

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 393 file(s), 2.63 MB of source, external domains: 0.0.0.0, 127.0.0.1, 192.168.1.5, a.example, ads.linkedin.com, api.example, api.telegram.org, api.xiaomimimo.com, api.z.ai, app.com, awin1.com, b.example, chatgpt.com, coupon.example.com, developer.mozilla.org, docs.a.com, docs.b.com, docs.example.com, docs.python.org, duckduckgo.com, example-ad.com, example.com, github.com, global.example, googleadservices.com, html.duckduckgo.com, ice1.somafm.com, lite.duckduckgo.com, mcp.asana.com, mcp.canva.com, mcp.notion.com, mediaworks.streamguys1.com, mpv.io, platform.example.com, project.example, reactbits.dev, search.brave.com, skills.sh, stream.radioparadise.com, t.me, token-plan-sgp.xiaomimimo.com, uiverse.io, www.bing.com, www.google.com, www.typescriptlang.org, x.example

Source & flagged code

5 flagged

dist/tools/html-extract.jsView file

Lines 10-50javascript

10 super(message);

11 this.name = "ExtractorUnavailable";

12 }

13}

14let cached = null;

15/**

16 * Lazily resolve the HTML→Markdown extraction stack (linkedom, Readability,

17 * Turndown + GFM plugin). Mirrors `loadChromium()` in screenshot.ts: dynamic

18 * imports behind a non-literal specifier so `tsc` does not statically require

19 * the optional dependencies, with results cached. Throws `ExtractorUnavailable`

20 * if any are missing so callers can degrade to the regex path.

21 */

22export async function loadExtractor() {

23 if (cached)

24 return cached;

25 const linkedomName = "linkedom";

26 const readabilityName = "@mozilla/readability";

27 const turndownName = "turndown";

28 const gfmName = "turndown-plugin-gfm";

29 try {

30 const [linkedom, readability, turndown, gfmMod] = (await Promise.all([

31 import(linkedomName),

32 import(readabilityName),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/html-extract.jsView on unpkg · L30

33 import(turndownName),

34 import(gfmName),

35 ]));

36 if (!linkedom.parseHTML || !readability.Readability || !turndown.default || !gfmMod.gfm) {

37 throw new ExtractorUnavailable("extraction modules loaded but expected exports are missing");

38 }

39 cached = {

40 parseHTML: linkedom.parseHTML,

41 Readability: readability.Readability,

42 TurndownService: turndown.default,

43 gfm: gfmMod.gfm,

44 };

45 return cached;

46 }

47 catch (err) {

48 if (err instanceof ExtractorUnavailable)

49 throw err;

50 throw new ExtractorUnavailable(err instanceof Error ? err.message : "failed to load extraction modules");

dist/core/hashline.jsView file

Lines 1-21javascript

1/**

2 * Hash-anchored line addressing — the pure, UI-free core shared by the hashline

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/hashline.jsView on unpkg · L1

3 * benchmark and the opt-in anchor guard in the read/edit tools.

4 *

5 * Every line gets a short content+position hash. Anchors are UNIQUE by

6 * construction (the line's index is folded into the hash, so blank/repeated

7 * lines never collide), which is what lets an edit either resolve to exactly one

8 * location or be rejected — never silently corrupt a file that drifted since the

9 * model last read it.

dist/core/radio.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync } from "node:fs";

3import path from "node:path";

4import { log } from "./logger.js";

5export const RADIO_STATIONS = [

dist/tools/web-fetch.jsView file

Lines 1-24javascript

1import { z } from "zod";

2import { extractToMarkdown } from "./html-extract.js";

3import { extractPdfText, PdfExtractorUnavailable } from "./pdf-extract.js";

4/**

5 * Block requests to private/internal network addresses to prevent SSRF.

6 * Checks the hostname against known private IP ranges and reserved domains.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web-fetch.js

dist/tools/subagent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kenkaiiii/ggcoder@5.4.2 matchedIdentity = npm:QGtlbmthaWlpaS9nZ2NvZGVy:5.4.2 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/tools/subagent.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/tools/html-extract.jsView file

30const [linkedom, readability, turndown, gfmMod] = (await Promise.all([ L31: import(linkedomName), L32: import(readabilityName),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/html-extract.jsView on unpkg · L30

dist/core/hashline.jsView file

1/** L2: * Hash-anchored line addressing — the pure, UI-free core shared by the hashline

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/hashline.jsView on unpkg · L1

dist/core/radio.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync } from "node:fs"; ... L9: description: "Chilled downtempo, ambient grooves", L10: url: "http://ice1.somafm.com/groovesalad-128-mp3", L11: }, ... L39: function extraPlayerDirs() { L40: switch (process.platform) { L41: case "darwin": ... L67: // 1) PATH (covers terminal launches + any inherited shell environment). L68: const pathDirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean); L69: // 2) Well-known dirs a GUI PATH typically omits. ... L78: * Streaming-capable players in priority order. Each gets its quietest flag

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/radio.jsView on unpkg · L1

dist/tools/web-fetch.jsView file

4/** L5: * Block requests to private/internal network addresses to prevent SSRF. L6: * Checks the hostname against known private IP ranges and reserved domains. ... L165: for (let hop = 0; hop <= MAX_REDIRECTS; hop++) { L166: const response = await fetch(currentUrl, { L167: headers: FETCH_HEADERS, ... L196: contentLength: contentLengthHeader ? Number(contentLengthHeader) : null, L197: body: response, L198: finalUrl: currentUrl, ... L225: } L226: const buffer = await response.body.arrayBuffer(); L227: if (buffer.byteLength > MAX_PDF_BYTES) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web-fetch.jsView on unpkg · L4

dist/tools/subagent.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/tools/subagent.jsView on unpkg

Findings

1 Critical2 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/tools/subagent.js

HighSandbox Evasion Gated Capabilitydist/core/radio.js

HighCloud Metadata Accessdist/tools/web-fetch.js

MediumDynamic Requiredist/tools/html-extract.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/core/hashline.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/tools/html-extract.jsView file

Lines 10-50javascript

10 super(message);

11 this.name = "ExtractorUnavailable";

12 }

13}

14let cached = null;

15/**

16 * Lazily resolve the HTML→Markdown extraction stack (linkedom, Readability,

17 * Turndown + GFM plugin). Mirrors `loadChromium()` in screenshot.ts: dynamic

18 * imports behind a non-literal specifier so `tsc` does not statically require

19 * the optional dependencies, with results cached. Throws `ExtractorUnavailable`

20 * if any are missing so callers can degrade to the regex path.

21 */

22export async function loadExtractor() {

23 if (cached)

24 return cached;

25 const linkedomName = "linkedom";

26 const readabilityName = "@mozilla/readability";

27 const turndownName = "turndown";

28 const gfmName = "turndown-plugin-gfm";

29 try {

30 const [linkedom, readability, turndown, gfmMod] = (await Promise.all([

31 import(linkedomName),

32 import(readabilityName),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/html-extract.jsView on unpkg · L30

33 import(turndownName),

34 import(gfmName),

35 ]));

36 if (!linkedom.parseHTML || !readability.Readability || !turndown.default || !gfmMod.gfm) {

37 throw new ExtractorUnavailable("extraction modules loaded but expected exports are missing");

38 }

39 cached = {

40 parseHTML: linkedom.parseHTML,

41 Readability: readability.Readability,

42 TurndownService: turndown.default,

43 gfm: gfmMod.gfm,

44 };

45 return cached;

46 }

47 catch (err) {

48 if (err instanceof ExtractorUnavailable)

49 throw err;

50 throw new ExtractorUnavailable(err instanceof Error ? err.message : "failed to load extraction modules");

dist/core/hashline.jsView file

Lines 1-21javascript

1/**

2 * Hash-anchored line addressing — the pure, UI-free core shared by the hashline

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/hashline.jsView on unpkg · L1

3 * benchmark and the opt-in anchor guard in the read/edit tools.

4 *

5 * Every line gets a short content+position hash. Anchors are UNIQUE by

6 * construction (the line's index is folded into the hash, so blank/repeated

7 * lines never collide), which is what lets an edit either resolve to exactly one

8 * location or be rejected — never silently corrupt a file that drifted since the

9 * model last read it.

dist/core/radio.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync } from "node:fs";

3import path from "node:path";

4import { log } from "./logger.js";

5export const RADIO_STATIONS = [

dist/tools/web-fetch.jsView file

Lines 1-24javascript

1import { z } from "zod";

2import { extractToMarkdown } from "./html-extract.js";

3import { extractPdfText, PdfExtractorUnavailable } from "./pdf-extract.js";

4/**

5 * Block requests to private/internal network addresses to prevent SSRF.

6 * Checks the hostname against known private IP ranges and reserved domains.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web-fetch.js

dist/tools/subagent.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/tools/subagent.jsView on unpkg