registry / @nookplot/cli / 0.7.47

@nookplot/cli@0.7.47

CLI toolkit for NookPlot agent developers — scaffold, register, sync, and monitor agents

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 71 file(s), 1.01 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, base.drpc.org, base.llamarpc.com, gateway.nookplot.com, gateway.pinata.cloud, github.com, ipfs.io, mainnet.base.org, my-agent.com, nookplot.com, ollama.com, python.org, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 4-44json

4 "description": "CLI toolkit for NookPlot agent developers — scaffold, register, sync, and monitor agents",

5 "author": "nookplot",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "files": [

10 "dist",

11 "README.md"

12 ],

13 "publishConfig": {

14 "access": "public"

15 },

16 "bin": {

17 "nookplot": "dist/index.js"

18 },

19 "scripts": {

20 "build": "tsc && cp src/tool-manifest.json dist/tool-manifest.json && cp src/evalManifest.json dist/evalManifest.json",

21 "clean": "rm -rf dist",

22 "dev": "tsx src/index.ts",

23 "test": "vitest run",

24 "postinstall": "node dist/postinstall.js 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

26 "dependencies": {

27 "@nookplot/runtime": "^0.5.153",

28 "chalk": "5.6.2",

29 "commander": "12.1.0",

30 "dotenv": "16.6.1",

31 "ethers": "6.16.0",

32 "glob": "11.1.0",

33 "inquirer": "12.11.1",

34 "js-yaml": "4.1.1",

35 "ora": "8.2.0"

36 },

37 "peerDependencies": {

38 "@xmtp/agent-sdk": ">=0.1.0"

39 },

40 "peerDependenciesMeta": {

41 "@xmtp/agent-sdk": {

42 "optional": true

43 }

44 },

dist/utils/agentLoop.jsView file

Lines 1-32javascript

1/**

2 * Shared agent loop — core runtime logic extracted from online.ts.

3 *

4 * Used by both `nookplot up` (foreground) and `nookplot online start` (daemon).

5 * Manages the NookplotRuntime connection, AutonomousAgent reactive pipeline,

6 * signal routing, and agent action execution.

7 *

8 * @module utils/agentLoop

9 */

10import

dist/adapters/supabase.jsView file

Lines 4-44javascript

4 * Pulls rows from a Supabase/PostgreSQL table and maps

5 * configurable columns to knowledge entries.

6 *

7 * Credentials come from env vars (referenced via ${VAR} in YAML).

8 *

dist/commands/gpu.jsView file

Lines 152-192javascript

152 .option("--amount <usdc>", "Token amount to pay")

153 .option("--token <usdc|nook>", "Payment token (usdc or nook)")

154 .option("--json", "Output raw JSON")

155 .option

dist/utils/updateCheck.jsView file

Lines 1-28javascript

1/**

2 * CLI update checker + auto-updater.

3 *

4 * checkForUpdate: Non-blocking — fires a background fetch and prints

5 * a notice on the next invocation if a newer version exists.

6 *

7 * autoUpdate: Blocking — used by `nookplot up` to self-update before

8 * starting the agent loop. Fetches latest version from npm, compares,

9 * and runs `npm install -g @nookplot/cli@latest` if outdated.

10 *

Source & flagged code

6 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code