registry / @onebrain-ai/cli / 3.4.2

@onebrain-ai/cli@3.4.2

Local-first Rust CLI for OneBrain — personal AI OS for Obsidian. Downloads the matching platform binary from GitHub Releases on install.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 18.1 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 16-51json

16 ],

17 "homepage": "https://onebrain.run",

18 "bugs": "https://github.com/onebrain-ai/onebrain-cli/issues",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/onebrain-ai/onebrain-cli.git"

22 },

23 "license": "MIT OR Apache-2.0",

24 "author": "OneBrain Contributors",

25 "bin": {

26 "onebrain": "bin/onebrain.js"

27 },

28 "files": [

29 "bin/",

30 "postinstall.js",

31 "README.md",

32 "LICENSE-MIT",

33 "LICENSE-APACHE"

34 ],

35 "scripts": {

36 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "engines": {

39 "node": ">=20"

40 },

41 "os": [

42 "darwin",

43 "linux",

44 "win32"

45 ],

46 "cpu": [

47 "x64",

48 "arm64"

49 ]

50}

bin/onebrain.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * @onebrain-ai/cli shim — execs the platform-native onebrain binary that

4 * `postinstall.js` extracted into this directory. Uniform across darwin,

5 * linux, and win32 so npm consumers get a single `onebrain` command name.

6 *

7 * Exit code is propagated from the child; if the binary is missing (e.g.

8 * postinstall was skipped via ONEBRAIN_CLI_SKIP_POSTINSTALL or failed),

9 * we print a helpful pointer and exit 127 (sysexits "command not found").

10 */

11'use strict';

postinstall.jsView file

Lines 8-48javascript

8 * (matches the rustup / esbuild / swc pattern). For a faster install path,

9 * see the optionalDependencies-per-platform layout we may switch to in

10 * v3.0.x.

11 *

12 * Knobs:

13 * ONEBRAIN_CLI_SKIP_POSTINSTALL

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/onebrain.jsView file

14const fs = require('node:fs'); L15: const { spawnSync } = require('node:child_process'); L16:

High

Child Process

Package source references child process execution.

bin/onebrain.jsView on unpkg · L14

postinstall.jsView file

28const path = require('node:path'); L29: const https = require('node:https'); L30: const crypto = require('node:crypto'); L31: const { execFileSync } = require('node:child_process'); L32: L33: if (process.env.ONEBRAIN_CLI_SKIP_POSTINSTALL) { L34: console.log('[@onebrain-ai/cli] ONEBRAIN_CLI_SKIP_POSTINSTALL set — skipping binary download.');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

postinstall.jsView on unpkg · L28

Findings

3 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/onebrain.js

HighSame File Env Network Executionpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 16-51json

16 ],

17 "homepage": "https://onebrain.run",

18 "bugs": "https://github.com/onebrain-ai/onebrain-cli/issues",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/onebrain-ai/onebrain-cli.git"

22 },

23 "license": "MIT OR Apache-2.0",

24 "author": "OneBrain Contributors",

25 "bin": {

26 "onebrain": "bin/onebrain.js"

27 },

28 "files": [

29 "bin/",

30 "postinstall.js",

31 "README.md",

32 "LICENSE-MIT",

33 "LICENSE-APACHE"

34 ],

35 "scripts": {

36 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "engines": {

39 "node": ">=20"

40 },

41 "os": [

42 "darwin",

43 "linux",

44 "win32"

45 ],

46 "cpu": [

47 "x64",

48 "arm64"

49 ]

50}

bin/onebrain.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * @onebrain-ai/cli shim — execs the platform-native onebrain binary that

4 * `postinstall.js` extracted into this directory. Uniform across darwin,

5 * linux, and win32 so npm consumers get a single `onebrain` command name.

6 *

7 * Exit code is propagated from the child; if the binary is missing (e.g.

8 * postinstall was skipped via ONEBRAIN_CLI_SKIP_POSTINSTALL or failed),

9 * we print a helpful pointer and exit 127 (sysexits "command not found").

10 */

11'use strict';

postinstall.jsView file

Lines 8-48javascript

8 * (matches the rustup / esbuild / swc pattern). For a faster install path,

9 * see the optionalDependencies-per-platform layout we may switch to in

10 * v3.0.x.

11 *

12 * Knobs:

13 * ONEBRAIN_CLI_SKIP_POSTINSTALL