registry / @mthanh/vespercli / 1.3.3

@mthanh/vespercli@1.3.3

Vesper Agent Suite — CLI to manage AI agents, prompts, instructions, and skills for GitHub Copilot (VS Code) and Claude Code

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 50 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 288 KB of source, external domains: 127.0.0.1, github.com, raw.githubusercontent.com

Source & flagged code

42 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "vespercli": "./bin/vesper.js"

9 },

10 "files": [

11 "bin",

12 "dist",

13 "src/mcp/vesper-indexing/dist",

Source & flagged code

42 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.min.jsView file

High

Child Process

Package source references child process execution.

dist/cli.min.jsView on unpkg · L1

1var Ht=(e,t)=>()=>(e&&(t=e(e=0)),t);import{access as Xt,constants as Qt,stat as Qn}from"node:fs/promises";async function h(e){try{return await Xt(e,Qt.F_OK),!0}catch{return!1}}var ... L2: `)}async function ks(e){let t=ht(e),s=xs(),n=new RegExp(`${Ee}[\\s\\S]*?${Te}`);if(!await h(t))return await q(Pe(t),{recursive:!0}),await T(t,`${s} ... L5: ${a}`;return await T(t,o,"utf-8"),{created:!1,updated:!0}}function As(e){let t=new RegExp(`${Ee}[\\s\\S]*?${Te}\\n*`);return e.replace(t,"")}async function we(e){let t=mt(e);await ... L6: `),n=setInterval(o,80),o()},update(i){a=i},stop(){n&&(clearInterval(n),n=null,process.stdout.write("\r"+" ".repeat(a.length+4)+"\r"))},succeed(i){this.stop(),console.log(`${x.green... L7: `))p.trim()&&r.info(p.replace("[vesper-indexing] ",""))}),o.stdout.on("data",l=>{i+=l.toString()}),o.on("close",l=>{try{let d=JSON.parse(i.trim());d.success?n?n.succeed(`Workspace ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.min.jsView on unpkg · L1

scripts/postinstall.jsView file

30stdio: 'inherit', L31: shell: true, L32: });

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L30

assets/claude/skills/chrome-devtools/scripts/evaluate.jsView file

31// eslint-disable-next-line no-eval L32: return eval(script); L33: }, args.script);

Low

Eval

Package source references a known benign dynamic code generation pattern.

assets/claude/skills/chrome-devtools/scripts/evaluate.jsView on unpkg · L31

assets/claude/skills/document-skills/xlsx/recalc.pyView file

•path = assets/claude/skills/document-skills/xlsx/recalc.py kind = build_helper sizeBytes = 6408 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/claude/skills/document-skills/xlsx/recalc.pyView on unpkg

assets/claude/skills/databases/scripts/tests/test_db_backup.pyView file

•path = [redacted]test_db_backup.py kind = payload_in_excluded_dir sizeBytes = 10800 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/claude/skills/databases/scripts/tests/test_db_backup.pyView on unpkg

assets/claude/agents/nodejs-express-developer.mdView file

556patternName = generic_password severity = medium line = 556 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in assets/claude/agents/nodejs-express-developer.md

assets/claude/agents/nodejs-express-developer.mdView on unpkg · L556

assets/claude/skills/backend-development/references/backend-testing.mdView file

60patternName = generic_password severity = medium line = 60 matchedText = const us...' };

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/backend-development/references/backend-testing.md

assets/claude/skills/backend-development/references/backend-testing.mdView on unpkg · L60

assets/claude/skills/better-auth/references/database-integration.mdView file

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/database-integration.md

assets/claude/skills/better-auth/references/database-integration.mdView on unpkg · L40

58patternName = generic_password severity = medium line = 58 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/database-integration.md

assets/claude/skills/better-auth/references/database-integration.mdView on unpkg · L58

assets/claude/skills/better-auth/references/email-password-auth.mdView file

51patternName = generic_password severity = medium line = 51 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L51

71patternName = generic_password severity = medium line = 71 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L71

167patternName = generic_password severity = medium line = 167 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L167

218patternName = generic_password severity = medium line = 218 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L218

226patternName = generic_password severity = medium line = 226 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L226

232patternName = generic_password severity = medium line = 232 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L232

400patternName = generic_password severity = medium line = 400 matchedText = password...rity

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L400

assets/claude/skills/better-auth/references/advanced-features.mdView file

47patternName = generic_password severity = medium line = 47 matchedText = password...tity

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L47

68patternName = generic_password severity = medium line = 68 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L68

77patternName = generic_password severity = medium line = 77 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L77

441patternName = generic_password severity = medium line = 441 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L441

516patternName = generic_password severity = medium line = 516 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L516

assets/claude/skills/better-auth/SKILL.mdView file

100patternName = generic_password severity = medium line = 100 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/SKILL.md

assets/claude/skills/better-auth/SKILL.mdView on unpkg · L100

107patternName = generic_password severity = medium line = 107 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/SKILL.md

assets/claude/skills/better-auth/SKILL.mdView on unpkg · L107

assets/agents/nodejs-express-developer/nodejs-express-developer.agent.mdView file

570patternName = generic_password severity = medium line = 570 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in assets/agents/nodejs-express-developer/nodejs-express-developer.agent.md

assets/agents/nodejs-express-developer/nodejs-express-developer.agent.mdView on unpkg · L570

assets/skills/backend-development/references/backend-testing.mdView file

60patternName = generic_password severity = medium line = 60 matchedText = const us...' };

Medium

Secret Pattern

Hardcoded password in assets/skills/backend-development/references/backend-testing.md

assets/skills/backend-development/references/backend-testing.mdView on unpkg · L60

assets/skills/better-auth/references/database-integration.mdView file

40patternName = generic_password severity = medium line = 40 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in assets/skills/better-auth/references/database-integration.md

assets/skills/better-auth/references/database-integration.mdView on unpkg · L40

58patternName = generic_password severity = medium line = 58 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in assets/skills/better-auth/references/database-integration.md

assets/skills/better-auth/references/database-integration.mdView on unpkg · L58

assets/skills/better-auth/references/email-password-auth.mdView file

51patternName = generic_password severity = medium line = 51 matchedText = password...23",

Medium

Secret Pattern