registry / @link-assistant/hive-mind / 2.1.5

@link-assistant/hive-mind@2.1.5

⚠ Under review

AI-powered issue solver and hive mind for collaborative problem solving

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 217 file(s), 3.35 MB of source, external domains: api.anthropic.com, api.openai.com, bun.sh, chatgpt.com, docs.github.com, gist.githubusercontent.com, github.com, models.dev, mycompany.youtrack.cloud, opencode.ai, platform.claude.com, status.anthropic.com, t.me, unpkg.com, www.githubstatus.com

Source & flagged code

6 flagged

src/hive.mjsView file

Lines 742-782javascript

742 // Track if this issue failed

743 let issueFailed = false;

744 // Issue #1823: Track a graceful shutdown stop so it is neither failed nor completed.

745 let gracefulStop = false;

746

747 // Process the issue multiple times if needed

748 for (let prNum = 1; prNum <= argv.pullRequestsPerIssue; prNum++) {

749 if (argv.pullRequestsPerIssue > 1) {

750 await log(` 📝 Creating PR ${prNum}/${argv.pullRequestsPerIssue} for issue`);

751 }

752

753 try {

754 // Execute solve command using spawn to enable real-time streaming while avoiding command-stream quoting issues

755 if (argv.dryRun) {

756 await log(` 🧪 [DRY RUN] Executing ${solveCommand} in dry-run mode for ${issueUrl}...`);

757 } else {

758 await log(` 🚀 Executing ${solveCommand} for ${issueUrl}...`);

759 }

760

761 const startTime = Date.now();

762 // Use spawn to get real-time streaming output while avoiding command-stream's automatic quote addition

763 const { spawn } = await import('child_process');

764 // Auto-forward all solve-passthrough options from hive argv to solve.

High

Child Process

Package source references child process execution.

src/hive.mjsView on unpkg · L762

765 // New options added to SOLVE_OPTION_DEFINITIONS are automatically forwarded.

766 // See: https://github.com/link-assistant/hive-mind/issues/1209

767 const { getSolvePassthroughOptionNames } = await import('./hive.config.lib.mjs');

768 const { SOLVE_OPTION_DEFINITIONS } = await import('./solve.config.lib.mjs');

769 const kebabToCamel = str => str.replace(/-([a-z])/g, (_, c) => c.toUpperCase());

770 const args = [issueUrl, '--model', argv.model];

771 // Special handling for options with different semantics in hive vs solve

772 // Validate branch name before forwarding (issue #1482: reject URLs used as branch names)

773 const branchValue = argv.baseBranch || argv.targetBranch;

774 if (branchValue) {

775 const { validateBranchName } = await import('./solve.branch.lib.mjs');

776 const branchValidation = validateBranchName(branchValue);

777 if (!branchValidation.valid) {

778 throw new Error(`Invalid branch name for --base-branch/--target-branch: ${branchValidation.reason}`);

779 }

780 args.push('--base-branch', branchValue);

781 }

782 if (argv.skipToolConnectionCheck || argv.toolConnectionCheck === false) args.push('--skip-tool-connection-check');

src/git.lib.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { exec } from 'child_process';

4import { promisify } from 'util';

6const execAsync = promisify(exec);

High

Shell

Package source references shell execution.

src/git.lib.mjsView on unpkg · L5

src/use-m-bootstrap.lib.mjsView file

Lines 24-53javascript

24 try {

25 return await fetchUseMCodeFromUrl(USE_M_BOOTSTRAP_FALLBACK_URL, fetcher);

26 } catch (fallbackError) {

27 throw new Error(`Failed to load use-m bootstrap from primary and fallback URLs: ${primaryError.message}; ${fallbackError.message}`, { cause: fallbackError });

src/solve.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Import Sentry instrumentation first (must be before other imports)

3import './instrument.mjs';

4import { ensureUseM } from './use-m-bootstrap.lib.mjs';

5const earlyArgs = process.argv.slice(2);

6const { handleSolveEarlyExit } = await

src/solve.auto-continue.lib.mjsView file

Lines 18-58javascript

18const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');

19const $ = wrapDollarWithGhRetry(__rawDollar$);

20// Import shared library functions

21const lib = await import('./lib.mjs');

src/limits.lib.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @link-assistant/hive-mind@2.1.0 matchedIdentity = npm:[redacted]:2.1.0 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/limits.lib.mjsView on unpkg

Source & flagged code

6 flagged · loading source

src/hive.mjsView file

762// Use spawn to get real-time streaming output while avoiding command-stream's automatic quote addition L763: const { spawn } = await import('child_process'); L764: // Auto-forward all solve-passthrough options from hive argv to solve.

High

Child Process

Package source references child process execution.

src/hive.mjsView on unpkg · L762

src/git.lib.mjsView file

5L6: const execAsync = promisify(exec); L7:

High

Shell

Package source references shell execution.

src/git.lib.mjsView on unpkg · L5

src/use-m-bootstrap.lib.mjsView file

44try { L45: globalThis.use = (await eval(await fetchUseMCode())).use; L46: } catch (error) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/use-m-bootstrap.lib.mjsView on unpkg · L44

src/solve.mjsView file

5const earlyArgs = process.argv.slice(2); L6: const { handleSolveEarlyExit } = await import('./solve.bootstrap.lib.mjs'); L7: await handleSolveEarlyExit(earlyArgs);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/solve.mjsView on unpkg · L5

src/solve.auto-continue.lib.mjsView file

38Cross-file remote execution chain: src/solve.auto-continue.lib.mjs spawns src/use-m-bootstrap.lib.mjs; helper contains network access plus dynamic code execution. L38: // Import usage limit formatting functions L39: // See: https://github.com/link-assistant/hive-mind/issues/1152 L40: const usageLimitLib = await import('./usage-limit.lib.mjs'); ... L148: // See: https://github.com/link-assistant/hive-mind/issues/1152 L149: const childProcess = await import('child_process'); L150: ... L217: stdio: 'inherit', L218: cwd: process.cwd(), L219: env: process.env, L220: }); ... L284: try { L285: parsed = JSON.parse(result.stdout.toString().trim() || '[]');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/solve.auto-continue.lib.mjsView on unpkg · L38

src/limits.lib.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/limits.lib.mjsView on unpkg

Findings

1 Critical3 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltasrc/limits.lib.mjs

HighChild Processsrc/hive.mjs

HighShellsrc/git.lib.mjs

HighCross File Remote Execution Contextsrc/solve.auto-continue.lib.mjs

MediumDynamic Requiresrc/solve.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/use-m-bootstrap.lib.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

src/hive.mjsView file

Lines 742-782javascript

742 // Track if this issue failed

743 let issueFailed = false;

744 // Issue #1823: Track a graceful shutdown stop so it is neither failed nor completed.

745 let gracefulStop = false;

746

747 // Process the issue multiple times if needed

748 for (let prNum = 1; prNum <= argv.pullRequestsPerIssue; prNum++) {

749 if (argv.pullRequestsPerIssue > 1) {

750 await log(` 📝 Creating PR ${prNum}/${argv.pullRequestsPerIssue} for issue`);

751 }

752

753 try {

754 // Execute solve command using spawn to enable real-time streaming while avoiding command-stream quoting issues

755 if (argv.dryRun) {

756 await log(` 🧪 [DRY RUN] Executing ${solveCommand} in dry-run mode for ${issueUrl}...`);

757 } else {

758 await log(` 🚀 Executing ${solveCommand} for ${issueUrl}...`);

759 }

760

761 const startTime = Date.now();

762 // Use spawn to get real-time streaming output while avoiding command-stream's automatic quote addition

763 const { spawn } = await import('child_process');

764 // Auto-forward all solve-passthrough options from hive argv to solve.

High

Child Process

Package source references child process execution.

src/hive.mjsView on unpkg · L762

765 // New options added to SOLVE_OPTION_DEFINITIONS are automatically forwarded.

766 // See: https://github.com/link-assistant/hive-mind/issues/1209

767 const { getSolvePassthroughOptionNames } = await import('./hive.config.lib.mjs');

768 const { SOLVE_OPTION_DEFINITIONS } = await import('./solve.config.lib.mjs');

769 const kebabToCamel = str => str.replace(/-([a-z])/g, (_, c) => c.toUpperCase());

770 const args = [issueUrl, '--model', argv.model];

771 // Special handling for options with different semantics in hive vs solve

772 // Validate branch name before forwarding (issue #1482: reject URLs used as branch names)

773 const branchValue = argv.baseBranch || argv.targetBranch;

774 if (branchValue) {

775 const { validateBranchName } = await import('./solve.branch.lib.mjs');

776 const branchValidation = validateBranchName(branchValue);

777 if (!branchValidation.valid) {

778 throw new Error(`Invalid branch name for --base-branch/--target-branch: ${branchValidation.reason}`);

779 }

780 args.push('--base-branch', branchValue);

781 }

782 if (argv.skipToolConnectionCheck || argv.toolConnectionCheck === false) args.push('--skip-tool-connection-check');

src/git.lib.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { exec } from 'child_process';

4import { promisify } from 'util';

6const execAsync = promisify(exec);

High

Shell

Package source references shell execution.

src/git.lib.mjsView on unpkg · L5

src/use-m-bootstrap.lib.mjsView file

Lines 24-53javascript

24 try {

25 return await fetchUseMCodeFromUrl(USE_M_BOOTSTRAP_FALLBACK_URL, fetcher);

26 } catch (fallbackError) {

27 throw new Error(`Failed to load use-m bootstrap from primary and fallback URLs: ${primaryError.message}; ${fallbackError.message}`, { cause: fallbackError });

src/solve.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Import Sentry instrumentation first (must be before other imports)

3import './instrument.mjs';

4import { ensureUseM } from './use-m-bootstrap.lib.mjs';

5const earlyArgs = process.argv.slice(2);

6const { handleSolveEarlyExit } = await

src/solve.auto-continue.lib.mjsView file

Lines 18-58javascript

18const { wrapDollarWithGhRetry } = await import('./github-rate-limit.lib.mjs');

19const $ = wrapDollarWithGhRetry(__rawDollar$);

20// Import shared library functions

21const lib = await import('./lib.mjs');

src/limits.lib.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/limits.lib.mjsView on unpkg