registry / @onebrain-ai/cli / 3.4.16

@onebrain-ai/cli@3.4.16

Local-first Rust CLI for OneBrain — personal AI OS. Downloads the matching platform binary from GitHub Releases on install.

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 18.1 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 15-50json

15 ],

16 "homepage": "https://onebrain.run",

17 "bugs": "https://github.com/onebrain-ai/onebrain-cli/issues",

18 "repository": {

19 "type": "git",

20 "url": "git+https://github.com/onebrain-ai/onebrain-cli.git"

21 },

22 "license": "MIT OR Apache-2.0",

23 "author": "OneBrain Contributors",

24 "bin": {

25 "onebrain": "bin/onebrain.js"

26 },

27 "files": [

28 "bin/",

29 "postinstall.js",

30 "README.md",

31 "LICENSE-MIT",

32 "LICENSE-APACHE"

33 ],

34 "scripts": {

35 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 },

37 "engines": {

38 "node": ">=20"

39 },

40 "os": [

41 "darwin",

42 "linux",

43 "win32"

44 ],

45 "cpu": [

46 "x64",

47 "arm64"

48 ]

49}

bin/onebrain.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * @onebrain-ai/cli shim — execs the platform-native onebrain binary that

4 * `postinstall.js` extracted into this directory. Uniform across darwin,

5 * linux, and win32 so npm consumers get a single `onebrain` command name.

6 *

7 * Exit code is propagated from the child; if the binary is missing (e.g.

8 * postinstall was skipped via ONEBRAIN_CLI_SKIP_POSTINSTALL or failed),

9 * we print a helpful pointer and exit 127 (sysexits "command not found").

10 */

postinstall.jsView file

Lines 8-48javascript

8 * (matches the rustup / esbuild / swc pattern). For a faster install path,

9 * see the optionalDependencies-per-platform layout we may switch to in

10 * v3.0.x.

11 *

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code