registry / @millsydotdev/ceoinabox / 1.3.2

@millsydotdev/ceoinabox@1.3.2

CEO-in-a-Box: AI department hierarchy plugin for OpenCode

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 203 KB of source, external domains: api.github.com, github.com

Source & flagged code

4 flagged

scripts/env-check.jsView file

Lines 1-48javascript

1#!/usr/bin/env node

2import { execSync } from 'child_process';

3import { readFileSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/env-check.jsView on unpkg · L1

5const TOOLS = [

6 { name: 'git', cmd: 'git', min: '2.30' },

7 { name: 'Node.js', cmd: 'node', min: '18.0' },

8 { name: 'npm', cmd: 'npm', min: '8.0' },

9 { name: 'Rust', cmd: 'rustc', min: '1.70' },

10 { name: 'Cargo', cmd: 'cargo', min: '1.70' },

11 { name: 'Go', cmd: 'go', min: '1.20' },

12 { name: '.NET SDK', cmd: 'dotnet', min: '8.0' },

13 { name: 'Java', cmd: 'java', min: '17' },

14 { name: 'Docker', cmd: 'docker', min: '24.0' },

15];

17function commandExists(cmd) {

18 try {

19 execSync(`which ${cmd}`, { stdio: 'ignore' });

20 return true;

21 } catch {

22 return false;

23 }

24}

26function getVersionOutput(cmd) {

27 let raw = '';

28 try {

29 raw = execSync(`${cmd} --version 2>&1`, { encoding: 'utf-8', timeout: 5_000, shell: true }).trim();

30 } catch (e) {

High

Shell

Package source references shell execution.

scripts/env-check.jsView on unpkg · L28

31 raw = (e.stdout || '').toString().trim() || (e.stderr || '').toString().trim();

32 }

33 if (!raw && cmd === 'java') {

34 try {

35 raw = execSync(`java -version 2>&1`, { encoding: 'utf-8', timeout: 5_000, shell: true }).trim();

36 } catch (e) {

37 raw = (e.stderr || e.stdout || '').toString().trim();

38 }

39 }

40 return raw;

41}

43function extractVersion(text) {

44 const m = text.match(/(\d+\.\d+(\.\d+)?)/);

45 return m ? m[1] : '?';

46}

48function parseVersion(v) {

scripts/validate.jsView file

Lines 9-49javascript

9const __dirname = dirname(__filename);

11function which(cmd) {

12 try {

13 execSync(`which ${cmd}`, { stdio: 'pipe' });

14 return true;

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 2404 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

Source & flagged code

4 flagged · loading source

scripts/env-check.jsView file

1#!/usr/bin/env node L2: import { execSync } from 'child_process'; L3: import { readFileSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/env-check.jsView on unpkg · L1

28try { L29: raw = execSync(`${cmd} --version 2>&1`, { encoding: 'utf-8', timeout: 5_000, shell: true }).trim(); L30: } catch (e) {

High

Shell

Package source references shell execution.

scripts/env-check.jsView on unpkg · L28

scripts/validate.jsView file

29try { L30: const out = execSync('npx tsc --noEmit', { cwd: p, encoding: 'utf8', stdio: 'pipe' }); L31: if (out) console.log(out);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/validate.jsView on unpkg · L29

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 2404 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processscripts/env-check.js

HighShellscripts/env-check.js

HighRuntime Package Installscripts/validate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperMakefile

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

scripts/env-check.jsView file

Lines 1-48javascript

1#!/usr/bin/env node

2import { execSync } from 'child_process';

3import { readFileSync, existsSync } from 'fs';

High

Child Process

Package source references child process execution.

scripts/env-check.jsView on unpkg · L1

5const TOOLS = [

6 { name: 'git', cmd: 'git', min: '2.30' },

7 { name: 'Node.js', cmd: 'node', min: '18.0' },

8 { name: 'npm', cmd: 'npm', min: '8.0' },

9 { name: 'Rust', cmd: 'rustc', min: '1.70' },

10 { name: 'Cargo', cmd: 'cargo', min: '1.70' },

11 { name: 'Go', cmd: 'go', min: '1.20' },

12 { name: '.NET SDK', cmd: 'dotnet', min: '8.0' },

13 { name: 'Java', cmd: 'java', min: '17' },

14 { name: 'Docker', cmd: 'docker', min: '24.0' },

15];

17function commandExists(cmd) {

18 try {

19 execSync(`which ${cmd}`, { stdio: 'ignore' });

20 return true;

21 } catch {

22 return false;

23 }

24}

26function getVersionOutput(cmd) {

27 let raw = '';

28 try {

29 raw = execSync(`${cmd} --version 2>&1`, { encoding: 'utf-8', timeout: 5_000, shell: true }).trim();

30 } catch (e) {

High

Shell

Package source references shell execution.

scripts/env-check.jsView on unpkg · L28

31 raw = (e.stdout || '').toString().trim() || (e.stderr || '').toString().trim();

32 }

33 if (!raw && cmd === 'java') {

34 try {

35 raw = execSync(`java -version 2>&1`, { encoding: 'utf-8', timeout: 5_000, shell: true }).trim();

36 } catch (e) {

37 raw = (e.stderr || e.stdout || '').toString().trim();

38 }

39 }

40 return raw;

41}

43function extractVersion(text) {

44 const m = text.match(/(\d+\.\d+(\.\d+)?)/);

45 return m ? m[1] : '?';

46}

48function parseVersion(v) {

scripts/validate.jsView file

Lines 9-49javascript

9const __dirname = dirname(__filename);

11function which(cmd) {

12 try {

13 execSync(`which ${cmd}`, { stdio: 'pipe' });

14 return true;

MakefileView file

•path = Makefile kind = build_helper sizeBytes = 2404 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

MakefileView on unpkg