registry / @odradekk/pi-square / 1.0.1

@odradekk/pi-square@1.0.1

Unified local extension package for Pi

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 1002 KB of source, external domains: api.firecrawl.dev, api.github.com, context7.com, r.jina.ai, s.jina.ai

Source & flagged code

8 flagged

wasm/no-spawn.cjsView file

Lines 1-34javascript

1// Preloaded via node --require before scheme.js runs.

2// Blocks process spawning unless full host access is explicitly enabled.

3// In readonly mode, also patches fs writes under the mounted host directory.

4"use strict";

6const mode = process.env.__SANDBOX_MODE;

8if (mode !== "fullaccess") {

9 const Module = require("module");

10 const _require = Module.prototype.require;

12 const blocked = () => ({ status: 1, signal: null, stdout: Buffer.alloc(0), stderr: Buffer.from("blocked by sandbox") });

13 const stub = {

14 spawnSync: blocked,

15 execSync() { throw new Error("blocked by sandbox"); },

16 execFileSync() { throw new Error("blocked by sandbox"); },

High

Child Process

Package source references child process execution.

wasm/no-spawn.cjsView on unpkg · L14

17 spawn() { throw new Error("blocked by sandbox"); },

18 exec() { throw new Error("blocked by sandbox"); },

19 execFile() { throw new Error("blocked by sandbox"); },

20 fork() { throw new Error("blocked by sandbox"); },

21 };

23 Module.prototype.require = function patchedRequire(id) {

24 if (id === "child_process" || id === "node:child_process") return stub;

25 return _require.apply(this, arguments);

26 };

27}

29if (mode === "readonly") {

30 const fs = require("fs");

31 const path = require("path");

32 const mountRoot = path.resolve(process.env.__SANDBOX_MOUNT_ROOT || "");

33 const trackedFds = new Map();

src/shell/spawn.tsView file

Lines 1-25typescript

1import { execFile, spawn } from "node:child_process";

3const IS_WINDOWS = process.platform === "win32";

5/**

6 * Resolved PowerShell binary chosen at session probe time.

7 * `name` is the bin name passed to spawn; `flavor` distinguishes PowerShell 7+ from Windows PowerShell 5.1.

wasm/scheme.jsView file

Lines 1-2javascript

1var Module=typeof Module!="undefined"?Module:{};var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalScope;var ENVIRONMENT_IS_NODE=globalThis.process?.versions?.node&&globalThis.process?.type!=

src/scheme/sandbox.tsView file

Lines 1-21typescript

1import { spawn, type ChildProcess } from "node:child_process";

2import { join } from "node:path";

3import { getWasmDir } from "./paths";

5/**

bin/win32-arm64/fd.exeView file

•path = bin/win32-arm64/fd.exe kind = native_binary sizeBytes = 3429888 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/win32-arm64/fd.exeView on unpkg

wasm/scheme.wasmView file

•path = wasm/scheme.wasm kind = wasm_module sizeBytes = 776126 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/scheme.wasmView on unpkg

skills/brainstorm/scripts/sanitize-topic.pyView file

•path = [redacted]-topic.py kind = build_helper sizeBytes = 902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/brainstorm/scripts/sanitize-topic.pyView on unpkg

Source & flagged code

8 flagged · loading source

wasm/no-spawn.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code