registry / @msawake/helioscode / 0.6.2

@msawake/helioscode@0.6.2

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 3.00 KB of source, external domains: storage.googleapis.com

Source & flagged code

1 flagged

bin/hc.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// hc.js — runtime shim for @msawake/helioscode

3//

4// Resolves the correct platform package, then spawns the pre-compiled binary

5// with the user's arguments. Follows the same pattern as esbuild and @swc/core.

6//

7// The binary inside each platform package lives at:

8// bin/hc (POSIX)

9// bin/hc.exe (Windows)

11'use strict';

13const { spawnSync } = require('child_process');

14const path = require('path');

16// ---------------------------------------------------------------------------

17// Platform → package mapping

18// ---------------------------------------------------------------------------

19const PLATFORM_MAP = {

20 'darwin-arm64': { pkg: '@msawake/helioscode-darwin-arm64', bin: 'bin/hc' },

21 'darwin-x64': { pkg: '@msawake/helioscode-darwin-x64', bin: 'bin/hc' },

22 'linux-x64': { pkg: '@msawake/helioscode-linux-x64', bin: 'bin/hc' },

23 'linux-arm64': { pkg: '@msawake/helioscode-linux-arm64', bin: 'bin/hc' },

24 'win32-x64': { pkg: '@msawake/helioscode-win32-x64', bin: 'bin/hc.exe' },

25};

27const key = `${process.platform}-${process.arch}`;

28const entry = PLATFORM_MAP[key];

30if (!entry) {

31 process.stderr.write(

32 `hc: unsupported platform: ${process.platform}/${process.arch}\n` +

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/hc.jsView on unpkg · L12

Source & flagged code

1 flagged · loading source

bin/hc.jsView file

12L13: const { spawnSync } = require('child_process'); L14: const path = require('path'); ... L26: L27: const key = `${process.platform}-${process.arch}`; L28: const entry = PLATFORM_MAP[key]; ... L30: if (!entry) { L31: process.stderr.write( L32: `hc: unsupported platform: ${process.platform}/${process.arch}\n` + ... L37: `Install via curl instead:\n` + L38: ` curl -fsSL https://storage.googleapis.com/hub-ally-code-dev-cli-releases/install.sh | bash\n` L39: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/hc.jsView on unpkg · L12

Findings

1 High1 Medium2 Low

HighSandbox Evasion Gated Capabilitybin/hc.js

MediumEnvironment Vars

LowUrl Strings

LowNo License