registry  /  @kitelev/exocortex-cli  /  16.185.9

@kitelev/exocortex-cli@16.185.9

CLI tool for Exocortex knowledge management system - SPARQL queries, task management, and more

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 1.38 MB of source, external domains: api.github.com, example.org, exocortex.local, exocortex.my, github.com, purl.org, schema.org, www.apache.org, www.w3.org, xmlns.com

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./scripts/postinstall.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/index.jsView file
17(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L18: (Did you mean ${n[0]}?)`:""}a(U6,"suggestSimilar");YR.suggestSimilar=U6});var eC=E(iS=>{var B6=require("node:events").EventEmitter,eS=require("node:child_process"),fo=require("node... L19: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComma...
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L17
506`)+` L507: `+r}a(df,"injectExocortexPrefixes");function $_(r){return r.replace(mce,(e,t,n,i,s)=>a5.has(n.toLowerCase())?`${n}:${i}`:e)}a($_,"transformShorthandNotation");function U_(r){let e=... L508: `);let N=$;N.type==="select"&&N.bindings?(console.log(`\u2705 Found ${N.bindings.length} result(s) ... L518: \u26A0\uFE0F Files skipped due to IRI issues:`);for(let u of o.skippedFiles)console.log(` - ${u.path}`),console.log(` ${u.reason}`);console.log("")}if(console.log(`\u2705 In... L519: \u{1F4CA} Cache Statistics:`),console.log(` Triples: ${u.tripleCount.toLocaleString()}`),console.log(` Created: ${u.createdAt.toISOString()}`),console.log(` Valid: ${u.isVali... L520: Hidden by precondition (${r.hidden.length}):`),r.hidden.length===0)console.log(" (none)");else for(let n of r.hidden)console.log(` \u2717 ${t(n)} \u2014 precondition not satisfie... L521: `),n={};for(let i of t){let s=i.match(/^(\w[\w]*):\s*(.*)$/);s&&(n[s[1]]=!0)}return n}a(T5,"extractFrontmatter");function A5(r){for(let e of Rx.keys())if(r.startsWith(e))return!0;r...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L506
17(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L18: (Did you mean ${n[0]}?)`:""}a(U6,"suggestSimilar");YR.suggestSimilar=U6});var eC=E(iS=>{var B6=require("node:events").EventEmitter,eS=require("node:child_process"),fo=require("node... L19: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComma... ... L30: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,s=>{let o;typeof t=="function"?o=t({error:s.error,command:s.command}):o=t,o&&s.write(`${o} L31: `)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();t&&e.find(i=>t.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function ZR(r){r... L32: `).map(n=>t+n)].join(`
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L17

Findings

4 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings