registry  /  @neko-catpital-labs/invoker-ui  /  0.0.7

@neko-catpital-labs/invoker-ui@0.0.7

Invoker desktop UI launcher

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
UrlStrings
Manifest
NoLicense
scanned 4 file(s), 8.17 KB of source, external domains: github.com

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/invoker-cli.jsView file
3import { dirname, join } from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { createRequire } from 'node:module';
High
Child Process

Package source references child process execution.

bin/invoker-cli.jsView on unpkg · L3
scripts/install.jsView file
7import { fileURLToPath } from 'node:url'; L8: import { execFileSync } from 'node:child_process'; L9: import { createRequire } from 'node:module'; ... L18: L19: const repo = process.env.INVOKER_RELEASE_REPOSITORY ?? 'Neko-Catpital-Labs/Invoker'; L20: const baseUrl = process.env.INVOKER_RELEASE_BASE_URL ?? `https://github.com/${repo}/releases/download/v${pkg.version}`; L21: const vendor = join(root, 'vendor');
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L7
10L11: const require = createRequire(import.meta.url); L12: const root = dirname(dirname(fileURLToPath(import.meta.url)));
Medium
Dynamic Require

Package source references dynamic require/import behavior.

scripts/install.jsView on unpkg · L10

Findings

4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/invoker-cli.js
HighShell
HighSame File Env Network Executionscripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/install.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License