registry / @microwiseai/snapshot / 0.8.0
@microwiseai/snapshot@0.8.0
CLI for installing IST Snapshot packages
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/lib/install-verify.jsView file
1import { execSync } from 'child_process';
L2: import { existsSync, readFileSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/lib/install-verify.jsView on unpkg · L1dist/commands/publish.jsView file
66return new Promise((resolve, reject) => {
L67: // NO shell:true. With a shell, /bin/sh -c would re-parse the joined argv and
L68: // a value like --bump 'patch; touch /tmp/pwn' could split the command,
High
node_modules/@microwiseai/license/dist/machine/instance.jsView file
Findings
4 High3 Medium6 Low
HighChild Processdist/lib/install-verify.js
HighShelldist/commands/publish.js
HighRuntime Package Installnode_modules/@microwiseai/skit/dist/lib.js
HighSemantic Analysis Limiteddist/lib/version-validator.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptonode_modules/@microwiseai/license/dist/machine/instance.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @microwiseai/snapshot@0.8.0.
See all versions of @microwiseai/snapshot for other recorded verdicts.
- Review the evidence and your use of @microwiseai/snapshot@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.