registry / @love-moon/ai-sdk / 0.7.6

@love-moon/ai-sdk@0.7.6

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 43 file(s), 544 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.github.com, api.githubcopilot.com, api.kimi.com, api.openai.com, auth.kimi.com, chatgpt.com, github.com

Source & flagged code

7 flagged

dist/client.jsView file

Lines 1-21javascript

1import { EventEmitter } from "node:events";

2import { spawn } from "node:child_process";

3import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/client.jsView on unpkg · L1

4import readline from "node:readline";

5import { assertSupportedBackend, createLocalAiSession, providerVariantForBackend, } from "./session-factory.js";

6import { DEFAULT_SESSION_CAPABILITIES, normalizeLogger, resolveSessionCapabilities, reviveError, } from "./shared.js";

7function createUnsupportedGoalError(name) {

8 const err = new Error(`runGoal() is not supported by backend session (${name || "unknown"}).`);

9 err.reason = "unsupported_goal";

10 return err;

11}

12const WORKER_PATH = fileURLToPath(new URL("./worker.js", import.meta.url));

13function sanitizeOptionsForWorker(options = {}) {

14 const sanitized = {};

15 for (const [key, value] of Object.entries(options)) {

16 if (typeof value === "function" || key === "logger") {

17 continue;

18 }

19 sanitized[key] = value;

20 }

21 return sanitized;

dist/providers/codex-exec-session.jsView file

Lines 320-360javascript

320 async emitAssistantMessage(text) {

321 const normalizedText = typeof text === "string" ? text : "";

322 if (

dist/external-provider-registry.jsView file

Lines 130-170javascript

130 aliases,

131 createSession: descriptor.createSession,

132 isSupported: optionalFn("isSupported"),

133 resolveResumeContext: optionalFn("resolveResumeContext"),

134 buildResumeArgs:

dist/resume/kimi.jsView file

Lines 69-109javascript

69 return null;

70}

71async function findKimiSessionTarget(sessionId, options = {}) {

72 const homeDir =

dist/manager/quota/claude.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { readFile } from "node:fs/promises";

3import { homedir } from "node:os";

4import { join } from "node:path";

dist/manager/quota/copilot.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @love-moon/ai-sdk@0.7.1 matchedIdentity = npm:QGxvdmUtbW9vbi9haS1zZGs:0.7.1 similarity = 0.732 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/manager/quota/copilot.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/client.jsView file

1import { EventEmitter } from "node:events"; L2: import { spawn } from "node:child_process"; L3: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/client.jsView on unpkg · L1

dist/providers/codex-exec-session.jsView file

340} L341: buildExecArgs({ useInitialImages = false, schemaFilePath = "", lastMessageFilePath = "" } = {}) { L342: const args = [...this.baseArgs];

High

Shell

Package source references shell execution.

dist/providers/codex-exec-session.jsView on unpkg · L340

dist/external-provider-registry.jsView file

150moduleUrl.searchParams.set("conductor-ai-sdk-provider-attempt", String(++externalProviderImportNonce)); L151: importedModule = await import(moduleUrl.href); L152: }

Findings

5 High4 Medium7 Low

HighChild Processdist/client.js

HighShelldist/providers/codex-exec-session.js

HighSame File Env Network Executiondist/manager/quota/claude.js

HighSandbox Evasion Gated Capabilitydist/manager/quota/claude.js

HighPrevious Version Dangerous Deltadist/manager/quota/copilot.js

MediumDynamic Requiredist/external-provider-registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/resume/kimi.js

LowFilesystem

LowHigh Entropy Strings