registry / @markus-global/cli / 0.8.5

@markus-global/cli@0.8.5

Markus — AI Digital Workforce Platform

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 75 file(s), 5.07 MB of source, external domains: api-st.siliconflow.cn, api.anthropic.com, api.deepseek.com, api.minimax.io, api.minimaxi.com, api.siliconflow.cn, api.z.ai, chevrotain.io, cursor.sh, en.wikipedia.org, github.com, langium.org, markus.global, openrouter.ai, react.dev, teavm.org, www.a, www.c, www.css, www.hortcut, www.icon, www.interpretation, www.language, www.markus.global, www.recent, www.style, www.text-decoration, www.w3.org, www.wencodeuricomponent, www.world, www.years

Oversized source lightweight scan

dist/markus.mjs14.8 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellUrlStringsapi.anthropic.comcursor.sh

Source & flagged code

6 flagged

dist/web-ui/assets/index-C0TJwd4k.jsView file

646`},m]}}const gQ=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\... L647: ]`,v={scope:"string",variants:[f,m,p,b]},N={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L648: https://github.com/highlightjs/highlight.js/issues/2277`),Jt=pe,St=Ye),lt===void 0&&(lt=!0);const gn={code:St,language:Jt};pr("before:highlight",gn);const tr=gn.result?gn.result:Wr...

High

Child Process

Package source references child process execution.

dist/web-ui/assets/index-C0TJwd4k.jsView on unpkg · L646

dist/commands/update.jsView file

40stdio: 'inherit', L41: shell: true, L42: });

High

Shell

Package source references shell execution.

dist/commands/update.jsView on unpkg · L40

Findings

4 High6 Medium7 Low

HighChild Processdist/web-ui/assets/index-C0TJwd4k.js

HighShelldist/commands/update.js

HighSame File Env Network Executiondist/utils/browser.js

HighPrevious Version Dangerous Deltadist/commands/start.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js

MediumOversized Cli Entrypointdist/markus.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

Affected versions and remediation

This report applies to @markus-global/cli@0.8.5.

See all versions of @markus-global/cli for other recorded verdicts.

Review the evidence and your use of @markus-global/cli@0.8.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-02 19:05:08.692Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @markus-global/cli / 0.8.5

@markus-global/cli@0.8.5

Markus — AI Digital Workforce Platform

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

Oversized source lightweight scan

dist/markus.mjs14.8 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellUrlStringsapi.anthropic.comcursor.sh

Source & flagged code

6 flagged

dist/web-ui/assets/index-C0TJwd4k.jsView file

High

Child Process

Package source references child process execution.

dist/web-ui/assets/index-C0TJwd4k.jsView on unpkg · L646

dist/commands/update.jsView file

40stdio: 'inherit', L41: shell: true, L42: });

High

Shell

Package source references shell execution.

dist/commands/update.jsView on unpkg · L40

Findings

4 High6 Medium7 Low

HighChild Processdist/web-ui/assets/index-C0TJwd4k.js

HighShelldist/commands/update.js

HighSame File Env Network Executiondist/utils/browser.js

HighPrevious Version Dangerous Deltadist/commands/start.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/web-ui/assets/plantuml-DezRDxd4.js

MediumOversized Cli Entrypointdist/markus.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

Affected versions and remediation

This report applies to @markus-global/cli@0.8.5.

See all versions of @markus-global/cli for other recorded verdicts.

Review the evidence and your use of @markus-global/cli@0.8.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-02 19:05:08.692Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.