registry / @kody-ade/kody-chat / 0.1.1

@kody-ade/kody-chat@0.1.1

⚠ Under review

broken build (accidental WIP); use 0.1.2

Kody Chat — multi-tenant branded client chat product and embeddable chat platform

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 646 file(s), 3.88 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.example.com, api.fly.io, api.github.com, api.githubcopilot.com, api.groq.com, api.machines.dev, api.minimax.io, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, cdn.jsdelivr.net, discord.com, fly.io, generativelanguage.googleapis.com, github.com, hooks.slack.com, keepachangelog.com, kody.local, openrouter.ai, r.jina.ai, raw.githubusercontent.com, semver.org, terminal-bridge.internal, www.githubstatus.com, www.w3.org

Source & flagged code

3 flagged

src/dashboard/lib/github-client.tsView file

Lines 113-153typescript

113/**

114 * Cross-instance invalidation via Next's Data Cache. Local instance already

115 * cleared its in-process Map above; this fans the same signal out to every

116 * other serverless instance so they don't keep serving stale data until TTL.

117 *

118 * Safe today: unknown tags are no-ops in Next. As reads migrate to

119 * `fetch(..., { next: { tags: ['gh:<tag>'] } })`, they automatically pick

120 * up cross-instance invalidation without touching this function again.

121 *

122 * Swallows errors — invalidation is best-effort; we never want a stale-data

123 * fix to throw and break the write that triggered it.

124 */

125function revalidateTagSafe(tag: string): void {

126 try {

127 // Lazy require keeps `next/cache` out of client bundles when

128 // github-client.ts is transitively imported by a client component

129 // (e.g. ModelsManager → variables/models → get-variable → here).

130 // Server-side this is a normal sync require; the client never reaches

131 // these write paths so the function is effectively a no-op there.

132 /* eslint-disable @typescript-eslint/no-require-imports */

133 const { revalidateTag } =

134 require("next/cache") as typeof import("next/cache");

135 /* eslint-enable @typescript-eslint/no-require-imports */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/dashboard/lib/github-client.tsView on unpkg · L133

136 revalidateTag(tag, { expire: 0 });

137 } catch {

138 // Outside a request scope (e.g. tests, scripts) revalidateTag throws.

139 // The in-process Map invalidation above is the authoritative path here.

140 }

141}

142

143/**

144 * Targeted cache invalidation by category

145 * Instead of clearing everything, only clear relevant caches

146 */

147export function invalidateTaskCache(): void {

148 invalidateCache("issues:");

149 invalidateCache("issue:");

150 invalidateCache("workflows:");

151 revalidateTagSafe("gh:issues");

152 revalidateTagSafe("gh:workflows");

153}

src/dashboard/lib/terminal/local-chat-session.tsView file

Lines 1-28typescript

1/**

2 * @fileType utility

3 * @domain terminal

4 * @pattern local-chat-terminal-session

5 *

6 * In-process PTY sessions for the chat rail's dumb terminal mode.

7 */

9import { spawnSync } from "node:child_process";

src/dashboard/lib/notifications/channels/discord.tsView file

Lines 1-33typescript

1/**

2 * Discord webhook adapter. POSTs JSON `{ content }` to a channel webhook.

3 * Get the URL: Server settings → Integrations → Webhooks → New Webhook → copy.

4 */

5import type { NotificationChannel } from "../../notifications";

6import type { SendContext } from "./index";

8type

Source & flagged code

3 flagged · loading source

src/dashboard/lib/github-client.tsView file

133const { revalidateTag } = L134: require("next/cache") as typeof import("next/cache"); L135: /* eslint-enable @typescript-eslint/no-require-imports */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/dashboard/lib/github-client.tsView on unpkg · L133

src/dashboard/lib/terminal/local-chat-session.tsView file

8L9: import { spawnSync } from "node:child_process"; L10: import { createHash } from "node:crypto"; ... L18: type: "output"; L19: data: string; L20: at: string; ... L68: onExit( L69: callback: (event: { exitCode: number; signal?: number }) => void, L70: ): void; ... L101: const NODE_PTY_PACKAGE = "node" + "-pty"; L102: const NODE_PTY_PACKAGE_JSON = `${NODE_PTY_PACKAGE}/package.json`; L103: const LOCAL_TERMINAL_UNAVAILABLE_MESSAGE =

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/dashboard/lib/terminal/local-chat-session.tsView on unpkg · L8

src/dashboard/lib/notifications/channels/discord.tsView file

13) { L14: return "Must be a Discord webhook URL (https://discord.com/api/webhooks/...)"; L15: } ... L26: headers: { "Content-Type": "application/json" }, L27: body: JSON.stringify({ content }), L28: }); L29: if (!res.ok) { L30: const detail = await res.text().catch(() => ""); L31: throw new Error(`Discord ${res.status}: ${detail.slice(0, 200)}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/dashboard/lib/notifications/channels/discord.tsView on unpkg · L13

Findings

1 Critical3 Medium5 Low

CriticalCredential Exfiltrationsrc/dashboard/lib/notifications/channels/discord.ts

MediumDynamic Requiresrc/dashboard/lib/github-client.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/dashboard/lib/terminal/local-chat-session.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/dashboard/lib/github-client.tsView file

Lines 113-153typescript

113/**

114 * Cross-instance invalidation via Next's Data Cache. Local instance already

115 * cleared its in-process Map above; this fans the same signal out to every

116 * other serverless instance so they don't keep serving stale data until TTL.

117 *

118 * Safe today: unknown tags are no-ops in Next. As reads migrate to

119 * `fetch(..., { next: { tags: ['gh:<tag>'] } })`, they automatically pick

120 * up cross-instance invalidation without touching this function again.

121 *

122 * Swallows errors — invalidation is best-effort; we never want a stale-data

123 * fix to throw and break the write that triggered it.

124 */

125function revalidateTagSafe(tag: string): void {

126 try {

127 // Lazy require keeps `next/cache` out of client bundles when

128 // github-client.ts is transitively imported by a client component

129 // (e.g. ModelsManager → variables/models → get-variable → here).

130 // Server-side this is a normal sync require; the client never reaches

131 // these write paths so the function is effectively a no-op there.

132 /* eslint-disable @typescript-eslint/no-require-imports */

133 const { revalidateTag } =

134 require("next/cache") as typeof import("next/cache");

135 /* eslint-enable @typescript-eslint/no-require-imports */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/dashboard/lib/github-client.tsView on unpkg · L133

136 revalidateTag(tag, { expire: 0 });

137 } catch {

138 // Outside a request scope (e.g. tests, scripts) revalidateTag throws.

139 // The in-process Map invalidation above is the authoritative path here.

140 }

141}

142

143/**

144 * Targeted cache invalidation by category

145 * Instead of clearing everything, only clear relevant caches

146 */

147export function invalidateTaskCache(): void {

148 invalidateCache("issues:");

149 invalidateCache("issue:");

150 invalidateCache("workflows:");

151 revalidateTagSafe("gh:issues");

152 revalidateTagSafe("gh:workflows");

153}

src/dashboard/lib/terminal/local-chat-session.tsView file

Lines 1-28typescript

1/**

2 * @fileType utility

3 * @domain terminal

4 * @pattern local-chat-terminal-session

5 *

6 * In-process PTY sessions for the chat rail's dumb terminal mode.

7 */

9import { spawnSync } from "node:child_process";

src/dashboard/lib/notifications/channels/discord.tsView file

Lines 1-33typescript

1/**

2 * Discord webhook adapter. POSTs JSON `{ content }` to a channel webhook.

3 * Get the URL: Server settings → Integrations → Webhooks → New Webhook → copy.

4 */

5import type { NotificationChannel } from "../../notifications";

6import type { SendContext } from "./index";

8type