registry / @mcpbox/daruma / 2.0.11

@mcpbox/daruma@2.0.11

Daruma Cloud plugin — RFC 8628 device-code pairing and /v1 API client

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 13 file(s), 45.9 KB of source, external domains: 127.0.0.1, daruma.mcpbox.ru, github.com

Source & flagged code

2 flagged

lib/codex-plugin.mjsView file

Lines 70-110javascript

70 }

71 } else {

72 await enableCodexPlugin(paths.codexConfigPath);

73 }

75 return {

76 pluginName: PLUGIN_NAME,

77 marketplaceName: MARKETPLACE_NAME,

78 sourcePluginDir: sourceDir,

79 pluginDir: paths.pluginDir,

80 marketplacePath: paths.marketplacePath,

81 codexConfigPath: paths.codexConfigPath,

82 installedWithCodex,

83 resourceUrl,

84 viewUrl: codexPluginUrl(paths.marketplacePath),

85 shareUrl: codexPluginUrl(paths.marketplacePath, "share"),

86 };

87}

89export async function installCodexPolicy({ pluginDir, projectDir }) {

90 const policyUrl = pathToFileURL(path.join(pluginDir, "lib", "policy.mjs"));

91 const { installPolicy } = await import(policyUrl.href);

92 return installPolicy({ projectDir });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/codex-plugin.mjsView on unpkg · L90

93}

95export function formatCodexPluginInstall(result) {

96 return [

97 "Codex plugin installed:",

98 ` Source: ${result.sourcePluginDir}`,

99 ` Plugin: ${result.pluginDir}`,

100 ` Marketplace: ${result.marketplacePath}`,

101 ` Codex config: ${result.codexConfigPath}`,

102 ` Codex install: ${result.installedWithCodex ? "codex plugin add daruma@personal" : "config fallback"}`,

103 ` MCP resource: ${result.resourceUrl}`,

104 ` Open in Codex: ${result.viewUrl}`,

105 ].join("\n");

106}

107

108async function installViaCodexCli({ runCommand = run } = {}) {

109 try {

110 await runCommand("codex", ["plugin", "add", `${PLUGIN_NAME}@${MARKETPLACE_NAME}`]);

•matchType = previous_version_dangerous_delta matchedPackage = @mcpbox/daruma@2.0.9 matchedIdentity = npm:QG1jcGJveC9kYXJ1bWE:2.0.9 similarity = 0.769 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/codex-plugin.mjsView on unpkg

Source & flagged code

2 flagged · loading source

lib/codex-plugin.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code