registry / @kunlv/atdc / 1.1.2

@kunlv/atdc@1.1.2

AI coding workflow orchestration kit — team edition

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 97.9 KB of source, external domains: www.npmjs.com

Source & flagged code

4 flagged

package.jsonView file

Lines 6-42json

6 "atdc": "bin/atdc.js",

7 "cls": "packages/cls/bin/cls.js"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "hooks/",

13 "prompts/",

14 "templates/",

15 "central/",

16 "scripts/",

17 "config/",

18 "packages/cls/",

19 "GO.md",

20 "install.sh",

21 "commands/",

22 "AGENTS.md",

23 "reference/"

24 ],

25 "scripts": {

26 "postinstall": "echo '📋 atdc 已安装。运行: atdc install --all'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "keywords": [

29 "ai",

30 "workflow",

31 "coding",

32 "spec-driven"

33 ],

34 "license": "MIT",

35 "engines": {

36 "node": ">=16"

37 },

38 "dependencies": {

39 "puppeteer": "^25.3.0"

40 }

41}

bin/atdc.jsView file

Lines 126-166javascript

126 const cfg = TERMINAL_CONFIGS[t];

127 console.log(`\n${cfg.name}:`);

128 const r = installers[t].

src/cli/publish.jsView file

Lines 97-128javascript

97 console.log('已取消。');

98 return;

99 }

100 }

101

102 // ── Publish ──

103 console.log('\n[publish] npm publish...');

bin/add-command.pyView file

•path = bin/add-command.py kind = build_helper sizeBytes = 5831 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/add-command.pyView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = echo '📋 atdc 已安装。运行: atdc install --all'

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code