registry / @microwiseai/snapshot
@microwiseai/snapshot
⚠ Under reviewCLI for installing IST Snapshot packages
This report shows the evidence for @microwiseai/snapshot@0.9.0. 0 of 4 known versions are blocked or flagged. See all versions.
Static Scan Results
scanned 8h ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/lib/install-verify.jsView file
1import { execSync } from 'child_process';
L2: import { existsSync, readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/lib/install-verify.jsView on unpkg · L1dist/commands/install.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @microwiseai/snapshot@0.8.0
matchedIdentity = npm:QG1pY3Jvd2lzZWFpL3NuYXBzaG90:0.8.0
similarity = 0.825
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/commands/install.jsView on unpkg299// is parsed exactly as it was under execSync.
L300: const child = spawn(command, { stdio: 'inherit', shell: true });
L301: child.on('error', (err) => {
Findings
1 Critical5 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/commands/install.js
HighChild Processdist/lib/install-verify.js
HighShelldist/commands/install.js
HighSame File Env Network Executiondist/lib/gitlab-publisher.js
HighRuntime Package Installnode_modules/@microwiseai/skit/dist/lib.js
HighSemantic Analysis Limiteddist/commands/publish.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptonode_modules/@microwiseai/license/dist/machine/instance.js
Low
Affected versions and remediation
This report applies to @microwiseai/snapshot@0.9.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @microwiseai/snapshot@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.