registry / @millsydotdev/ceoinabox / 1.9.2

@millsydotdev/ceoinabox@1.9.2

AI department hierarchy plugin for OpenCode — CEO delegates work across 17 specialist engineering agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 801 KB of source, external domains: api.github.com, codeberg.org, evil.example.com, github.com, gitlab.com, opencode.ai

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import { fileURLToPath } from 'url';

6import { spawn } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10const PLUGIN_ROOT = path.resolve(__dirname, '..');

12const command = process.argv[2];

13const args = process.argv.slice(3);

15function printHelp() {

16 console.log('\\n🚀 \\x1b[35mCEOinaBox CLI\\x1b[0m\\n');

17 console.log('Usage: npx @millsydotdev/ceoinabox <command>\\n');

18 console.log('Commands:');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L5

19 console.log(' \\x1b[36msetup\\x1b[0m Initialize workspace, create opencode.json, and prepare for OpenCode');

20 console.log(' \\x1b[36mdoctor\\x1b[0m Run diagnostics on the current CEOinaBox installation');

21 console.log(' \\x1b[36msync\\x1b[0m Synchronize agent configurations and instructions');

22 console.log(' \\x1b[36mvalidate\\x1b[0m Validate the architecture contract of the plugin');

23 console.log(' \\x1b[36mhelp\\x1b[0m Show this help menu\\n');

24}

scripts/download-skill.jsView file

Lines 7-47javascript

7import { fileURLToPath } from 'url';

8import https from 'https';

9import http from 'http';

10import os from 'os';

12const __dirname = path.

scripts/test-perf.jsView file

Lines 30-70javascript

30 const times = [];

31 for (let i = 0; i < iterations; i++) {

32 const start = performance.now();

33 fn(i);

34 times.

scripts/render-social-preview.shView file

•path = scripts/render-social-preview.sh kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/render-social-preview.shView on unpkg

Source & flagged code

5 flagged · loading source

bin/cli.jsView file

5import { fileURLToPath } from 'url'; L6: import { spawn } from 'child_process'; L7:

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

5import { fileURLToPath } from 'url'; L6: import { spawn } from 'child_process'; L7: ... L16: console.log('\\n🚀 \\x1b[35mCEOinaBox CLI\\x1b[0m\\n'); L17: console.log('Usage: npx @millsydotdev/ceoinabox <command>\\n'); L18: console.log('Commands:');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L5

scripts/download-skill.jsView file

27[/base64\s*-d.*(\||`|\$)/i, 'base64 decode/exec'], L28: [/(sh\s+-i|bash\s+-i|nc\s+-e|powershell\s+-enc)/i, 'reverse shell'], L29: [/rm\s+(-rf|-r\s+-f|--recursive\s+--force)\s+\//i, 'rm -rf'],

High

Shell

Package source references shell execution.

scripts/download-skill.jsView on unpkg · L27

scripts/test-perf.jsView file

50bench('Import infrastructure modules', () => { L51: import('./infra/index.js'); L52: }, 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/test-perf.jsView on unpkg · L50

scripts/render-social-preview.shView file

•path = scripts/render-social-preview.sh kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/render-social-preview.shView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processbin/cli.js

HighShellscripts/download-skill.js

HighRuntime Package Installbin/cli.js

MediumDynamic Requirescripts/test-perf.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/render-social-preview.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import { fileURLToPath } from 'url';

6import { spawn } from 'child_process';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10const PLUGIN_ROOT = path.resolve(__dirname, '..');

12const command = process.argv[2];

13const args = process.argv.slice(3);

15function printHelp() {

16 console.log('\\n🚀 \\x1b[35mCEOinaBox CLI\\x1b[0m\\n');

17 console.log('Usage: npx @millsydotdev/ceoinabox <command>\\n');

18 console.log('Commands:');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L5

19 console.log(' \\x1b[36msetup\\x1b[0m Initialize workspace, create opencode.json, and prepare for OpenCode');

20 console.log(' \\x1b[36mdoctor\\x1b[0m Run diagnostics on the current CEOinaBox installation');

21 console.log(' \\x1b[36msync\\x1b[0m Synchronize agent configurations and instructions');

22 console.log(' \\x1b[36mvalidate\\x1b[0m Validate the architecture contract of the plugin');

23 console.log(' \\x1b[36mhelp\\x1b[0m Show this help menu\\n');

24}

scripts/download-skill.jsView file

Lines 7-47javascript

7import { fileURLToPath } from 'url';

8import https from 'https';

9import http from 'http';

10import os from 'os';

12const __dirname = path.

scripts/test-perf.jsView file

Lines 30-70javascript

30 const times = [];

31 for (let i = 0; i < iterations; i++) {

32 const start = performance.now();

33 fn(i);

34 times.

scripts/render-social-preview.shView file

•path = scripts/render-social-preview.sh kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/render-social-preview.shView on unpkg