registry / @love-moon/ai-sdk / 0.7.1

@love-moon/ai-sdk@0.7.1

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 529 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.github.com, api.githubcopilot.com, api.kimi.com, api.openai.com, auth.kimi.com, chatgpt.com, github.com

Source & flagged code

6 flagged

dist/client.jsView file

Lines 1-21javascript

1import { EventEmitter } from "node:events";

2import { spawn } from "node:child_process";

3import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/client.jsView on unpkg · L1

4import readline from "node:readline";

5import { assertSupportedBackend, createLocalAiSession, providerVariantForBackend, } from "./session-factory.js";

6import { DEFAULT_SESSION_CAPABILITIES, normalizeLogger, resolveSessionCapabilities, reviveError, } from "./shared.js";

7function createUnsupportedGoalError(name) {

8 const err = new Error(`runGoal() is not supported by backend session (${name || "unknown"}).`);

9 err.reason = "unsupported_goal";

10 return err;

11}

12const WORKER_PATH = fileURLToPath(new URL("./worker.js", import.meta.url));

13function sanitizeOptionsForWorker(options = {}) {

14 const sanitized = {};

15 for (const [key, value] of Object.entries(options)) {

16 if (typeof value === "function" || key === "logger") {

17 continue;

18 }

19 sanitized[key] = value;

20 }

21 return sanitized;

dist/providers/codex-exec-session.jsView file

Lines 320-360javascript

320 async emitAssistantMessage(text) {

321 const normalizedText = typeof text === "string" ? text : "";

322 if (

dist/external-provider-registry.jsView file

Lines 130-170javascript

130 aliases,

131 createSession: descriptor.createSession,

132 isSupported: optionalFn("isSupported"),

133 resolveResumeContext: optionalFn("resolveResumeContext"),

134 buildResumeArgs:

dist/resume/kimi.jsView file

Lines 1-21javascript

1import crypto from "node:crypto";

2import { promises as fsp } from "node:fs";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/resume/kimi.jsView on unpkg · L1

3import path from "node:path";

dist/manager/quota/claude.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { readFile } from "node:fs/promises";

3import { homedir } from "node:os";

4import { join } from "node:path";

Source & flagged code

6 flagged · loading source

dist/client.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code