Static Scan Results
scanned 9h ago · by rust-scannerStatic analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
CopyleftLicense
Oversized source lightweight scan
daemon/index.js2.06 MB file, sampled 256 KB
FilesystemNetworkEnvironmentVarsCryptoHighEntropyStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/ensure-tree-sitter.mjs && node scripts/ensure-embed-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/ensure-tree-sitter.mjs && node scripts/ensure-embed-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgharnesses/claude-code/bundle/pre-tool-use.jsView file
16133// dist/src/hooks/shared/project-resolver.js
L16134: import { execFileSync } from "node:child_process";
L16135: import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
High
Child Process
Package source references child process execution.
harnesses/claude-code/bundle/pre-tool-use.jsView on unpkg · L16133bundle/cli.jsView file
17302function [redacted](platform2 = process.platform) {
L17303: const command = platform2 === "win32" ? 'powershell -c "& { $(irm https://get.theapiary.sh/install.ps1) } --products=honeycomb,doctor,hive"' : "curl -fsSL https://get.theapiary.sh ...
L17304: return `Dashboard portal is not running; install it with ${command}.`;
High
132Cross-file remote execution chain: bundle/cli.js spawns harnesses/claude-code/bundle/pre-tool-use.js; helper contains network access plus dynamic code execution.
L132: ZodArray: () => ZodArray,
L133: ZodBase64: () => ZodBase64,
L134: ZodBase64URL: () => ZodBase64URL,
...
L1593: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L1594: } : { success: true, data: result.value };
L1595: };
...
L2677: try {
L2678: new URL(`http://[${payload.value}]`);
L2679: } catch {
...
L14662: function resolveFleetRoot(options = {}) {
L14663: const env = options.env ?? process.env;
L14664: const platform2 = options.platform ?? process.platform;
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bundle/cli.jsView on unpkg · L132132ZodArray: () => ZodArray,
L133: ZodBase64: () => ZodBase64,
L134: ZodBase64URL: () => ZodBase64URL,
...
L1593: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L1594: } : { success: true, data: result.value };
L1595: };
...
L2677: try {
L2678: new URL(`http://[${payload.value}]`);
L2679: } catch {
...
L14662: function resolveFleetRoot(options = {}) {
L14663: const env = options.env ?? process.env;
L14664: const platform2 = options.platform ?? process.platform;
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bundle/cli.jsView on unpkg · L132embeddings/embed-daemon.jsView file
34const moduleSpecifier = "@huggingface/transformers";
L35: const dynamicImport = new Function("m", "return import(m);");
L36: return await dynamicImport(moduleSpecifier);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
embeddings/embed-daemon.jsView on unpkg · L3434const moduleSpecifier = "@huggingface/transformers";
L35: const dynamicImport = new Function("m", "return import(m);");
L36: return await dynamicImport(moduleSpecifier);
Low
Eval
Package source references a known benign dynamic code generation pattern.
embeddings/embed-daemon.jsView on unpkg · L34daemon/restart-helper.jsView file
1// dist/src/daemon/restart-helper.js
L2: import { spawn } from "node:child_process";
L3: var port = Number(process.env.HONEYCOMB_RESTART_PORT ?? "3850");
L4: var entry = process.env.HONEYCOMB_RESTART_ENTRY ?? "";
...
L8: var LOCK_RELEASE_GRACE_MS = 800;
L9: var healthUrl = `http://127.0.0.1:${Number.isFinite(port) && port > 0 ? port : 3850}/health`;
L10: async function stillUp() {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
daemon/restart-helper.jsView on unpkg · L1assets/logos/fonts/JetBrainsMono-Regular.woff2View file
•path = [redacted]-Regular.woff2
kind = high_entropy_blob
sizeBytes = 92164
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
assets/logos/fonts/JetBrainsMono-Regular.woff2View on unpkgdaemon/index.jsView file
•path = daemon/index.js
kind = oversized_source_file
sizeBytes = 2162166
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
daemon/index.jsView on unpkgFindings
7 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processharnesses/claude-code/bundle/pre-tool-use.js
HighShellbundle/cli.js
HighSame File Env Network Executiondaemon/restart-helper.js
HighCross File Remote Execution Contextbundle/cli.js
HighShips High Entropy Blobassets/logos/fonts/JetBrainsMono-Regular.woff2
HighOversized Source Filedaemon/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireembeddings/embed-daemon.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebundle/cli.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalembeddings/embed-daemon.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License