registry / @opencodehub/cli / 0.10.6

@opencodehub/cli@0.10.6

OpenCodeHub — codehub CLI (analyze, setup, mcp, list, status, clean, query, context, impact, sql)

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 1.53 MB of source, external domains: cyclonedx.org, docs.astral.sh, dotnet.microsoft.com, git-scm.com, github.com, repo1.maven.org

Source & flagged code

5 flagged

dist/doctor-FS4YNQ2E.jsView file

Lines 120-160javascript

120function pnpmInstalledCheck(run) {

121 return {

122 name: "pnpm installed",

123 async run() {

124 const res = await run("pnpm", ["--version"]);

125 if (res.status !== 0) {

126 return {

127 status: "fail",

128 message: "pnpm not on PATH",

129 hint: "install pnpm via `npm install -g pnpm` or `corepack enable`"

130 };

131 }

132 return { status: "ok", message: `pnpm ${res.stdout.trim()}` };

133 }

134 };

135}

136function nodeSqliteCheck() {

137 return {

138 name: "node:sqlite built-in",

139 async run() {

140 try {

141 const mod = await import("node:sqlite");

142 const DatabaseSync = mod.DatabaseSync;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/doctor-FS4YNQ2E.jsView on unpkg · L140

143 if (typeof DatabaseSync !== "function") {

144 return {

145 status: "fail",

146 message: "node:sqlite imported but exports no DatabaseSync constructor",

147 hint: nodeSqliteFailureHint()

148 };

149 }

150 const db = new DatabaseSync(":memory:");

151 try {

152 db.exec("PRAGMA journal_mode=WAL");

153 db.exec("CREATE TABLE doctor_probe (n INTEGER)");

154 db.prepare("INSERT INTO doctor_probe (n) VALUES (1)").run();

155 const row = db.prepare("SELECT n FROM doctor_probe").get();

156 if (row?.n !== 1) {

157 return {

158 status: "fail",

159 message: "node:sqlite round-trip returned an unexpected value",

160 hint: nodeSqliteFailureHint()

dist/chunk-IZKCCDTF.jsView file

Lines 2-42javascript

2 resolveAsset

3} from "./chunk-QQ3MLBC3.js";

4import {

5 F2LLM_V2_80M_PINS,

6 resolveModelDir

7} from "./chunk-Z5PXOKZ2.js";

8import {

9 writeFileAtomic

10} from "./chunk-XKUT2KFN.js";

dist/chunk-JNQTNVU5.jsView file

18395package = @opencodehub/cli; repositoryIdentity = opencodehub; dependency = @apidevtools/swagger-parser L18395: try { L18396: const mod = await import("@apidevtools/swagger-parser"); L18397: SwaggerParser = mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-JNQTNVU5.jsView on unpkg · L18395

dist/vendor/wasms/tree-sitter-go.wasmView file

•path = dist/vendor/wasms/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/wasms/tree-sitter-go.wasmView on unpkg

dist/plugin-assets/hooks/docs-staleness.shView file

•path = dist/plugin-assets/hooks/docs-staleness.sh kind = build_helper sizeBytes = 1580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin-assets/hooks/docs-staleness.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/doctor-FS4YNQ2E.jsView file

140try { L141: const mod = await import("node:sqlite"); L142: const DatabaseSync = mod.DatabaseSync;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/doctor-FS4YNQ2E.jsView on unpkg · L140

dist/chunk-IZKCCDTF.jsView file

22import { homedir as homedir6 } from "node:os"; L23: import { dirname as dirname4, join as join4, resolve as resolve6 } from "node:path"; L24: import { fileURLToPath as fileURLToPath2 } from "node:url"; ... L26: // src/cobol-proleap-setup.ts L27: import { spawn } from "node:child_process"; L28: import { statSync } from "node:fs"; ... L50: }); L51: let stdout = ""; L52: let stderr = ""; ... L211: function defaultVendorDir(home) { L212: return join(home ?? homedir(), ".codehub", "vendor", "proleap"); L213: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-IZKCCDTF.jsView on unpkg · L22

dist/chunk-JNQTNVU5.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-JNQTNVU5.jsView on unpkg · L18395

dist/vendor/wasms/tree-sitter-go.wasmView file

•path = dist/vendor/wasms/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/wasms/tree-sitter-go.wasmView on unpkg

dist/plugin-assets/hooks/docs-staleness.shView file

•path = dist/plugin-assets/hooks/docs-staleness.sh kind = build_helper sizeBytes = 1580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin-assets/hooks/docs-staleness.shView on unpkg

Findings

2 High5 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/chunk-IZKCCDTF.js

HighCopied Package Dependency Bridgedist/chunk-JNQTNVU5.js

MediumDynamic Requiredist/doctor-FS4YNQ2E.js

MediumEnvironment Vars

MediumShips Wasm Moduledist/vendor/wasms/tree-sitter-go.wasm

MediumShips Build Helperdist/plugin-assets/hooks/docs-staleness.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/doctor-FS4YNQ2E.jsView file

Lines 120-160javascript

120function pnpmInstalledCheck(run) {

121 return {

122 name: "pnpm installed",

123 async run() {

124 const res = await run("pnpm", ["--version"]);

125 if (res.status !== 0) {

126 return {

127 status: "fail",

128 message: "pnpm not on PATH",

129 hint: "install pnpm via `npm install -g pnpm` or `corepack enable`"

130 };

131 }

132 return { status: "ok", message: `pnpm ${res.stdout.trim()}` };

133 }

134 };

135}

136function nodeSqliteCheck() {

137 return {

138 name: "node:sqlite built-in",

139 async run() {

140 try {

141 const mod = await import("node:sqlite");

142 const DatabaseSync = mod.DatabaseSync;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/doctor-FS4YNQ2E.jsView on unpkg · L140

143 if (typeof DatabaseSync !== "function") {

144 return {

145 status: "fail",

146 message: "node:sqlite imported but exports no DatabaseSync constructor",

147 hint: nodeSqliteFailureHint()

148 };

149 }

150 const db = new DatabaseSync(":memory:");

151 try {

152 db.exec("PRAGMA journal_mode=WAL");

153 db.exec("CREATE TABLE doctor_probe (n INTEGER)");

154 db.prepare("INSERT INTO doctor_probe (n) VALUES (1)").run();

155 const row = db.prepare("SELECT n FROM doctor_probe").get();

156 if (row?.n !== 1) {

157 return {

158 status: "fail",

159 message: "node:sqlite round-trip returned an unexpected value",

160 hint: nodeSqliteFailureHint()

dist/chunk-IZKCCDTF.jsView file

Lines 2-42javascript

2 resolveAsset

3} from "./chunk-QQ3MLBC3.js";

4import {

5 F2LLM_V2_80M_PINS,

6 resolveModelDir

7} from "./chunk-Z5PXOKZ2.js";

8import {

9 writeFileAtomic

10} from "./chunk-XKUT2KFN.js";

dist/chunk-JNQTNVU5.jsView file

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-JNQTNVU5.jsView on unpkg · L18395

dist/vendor/wasms/tree-sitter-go.wasmView file

•path = dist/vendor/wasms/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/wasms/tree-sitter-go.wasmView on unpkg

dist/plugin-assets/hooks/docs-staleness.shView file

•path = dist/plugin-assets/hooks/docs-staleness.sh kind = build_helper sizeBytes = 1580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin-assets/hooks/docs-staleness.shView on unpkg