registry / @neko-catpital-labs/invoker-ui / 0.0.7

@neko-catpital-labs/invoker-ui@0.0.7

Invoker desktop UI launcher

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 4 file(s), 8.17 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 9-32json

9 "directory": "packages/npm-ui"

10 },

11 "bin": {

12 "invoker-ui": "bin/invoker-ui.js",

13 "invoker-cli": "bin/invoker-cli.js"

14 },

15 "files": [

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/invoker-cli.jsView file

3import { dirname, join } from 'node:path'; L4: import { spawnSync } from 'node:child_process'; L5: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/invoker-cli.jsView on unpkg · L3

scripts/install.jsView file

7import { fileURLToPath } from 'node:url'; L8: import { execFileSync } from 'node:child_process'; L9: import { createRequire } from 'node:module'; ... L18: L19: const repo = process.env.INVOKER_RELEASE_REPOSITORY ?? 'Neko-Catpital-Labs/Invoker'; L20: const baseUrl = process.env.INVOKER_RELEASE_BASE_URL ?? `https://github.com/${repo}/releases/download/v${pkg.version}`; L21: const vendor = join(root, 'vendor');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L7

10L11: const require = createRequire(import.meta.url); L12: const root = dirname(dirname(fileURLToPath(import.meta.url)));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install.jsView on unpkg · L10

Findings

4 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/invoker-cli.js

HighShell

HighSame File Env Network Executionscripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/install.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

bin/invoker-cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { existsSync } from 'node:fs';

3import { dirname, join } from 'node:path';

4import { spawnSync } from 'node:child_process';

5import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/invoker-cli.jsView on unpkg · L3

7const require = createRequire(import.meta.url);

9let cliPackageJson;

10try {

11 cliPackageJson = require.resolve('@neko-catpital-labs/invoker-cli/package.json');

12} catch {

13 console.error(

14 'The @neko-catpital-labs/invoker-cli dependency is not installed. Reinstall @neko-catpital-labs/invoker-ui.',

15 );

16 process.exit(1);

17}

19const binary = join(dirname(cliPackageJson), 'vendor', 'invoker-cli');

21if (!existsSync(binary)) {

22 console.error(

23 `invoker-cli binary is missing at ${binary}. Its postinstall did not run or failed — ` +

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import { createHash } from 'node:crypto';

3import { createWriteStream, existsSync } from 'node:fs';

4import { chmod, mkdir, readFile, rm } from 'node:fs/promises';

5import { dirname, join } from 'node:path';

6import { pipeline } from 'node:stream/promises';

7import { fileURLToPath } from 'node:url';

8import { execFileSync } from 'node:child_process';

9import { createRequire } from 'node:module';

11const require = createRequire(import.meta.url);

12const root = dirname(dirname(fileURLToPath(import.meta.url)));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install.jsView on unpkg · L10

13const pkg = require(join(root, 'package.json'));

15if (existsSync(join(root, '..', '..', 'pnpm-workspace.yaml'))) {

16 process.exit(0);

17}

19const repo = process.env.INVOKER_RELEASE_REPOSITORY ?? 'Neko-Catpital-Labs/Invoker';

20const baseUrl = process.env.INVOKER_RELEASE_BASE_URL ?? `https://github.com/${repo}/releases/download/v${pkg.version}`;

21const vendor = join(root, 'vendor');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L7

23const arch = process.arch;

24const linuxAssetArch = arch === 'x64' ? 'x86_64' : arch;

25const asset = process.platform === 'darwin'

26 ? `Invoker-${pkg.version}-${arch}.zip`

27 : process.platform === 'linux'

28 ? `Invoker-${pkg.version}-${linuxAssetArch}.AppImage`

29 : undefined;