registry / @openprd/cli / 0.1.21

@openprd/cli@0.1.21

AI-native PRD workspace and lifecycle CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 139 file(s), 2.79 MB of source, external domains: commons.wikimedia.org, context7.com, docs.devin.ai, esm.sh, github.com, lobehub.com, mcp.context7.com, mcp.deepwiki.com, openprd.local, phosphoricons.com, techicons.dev, www.iconfont.cn, www.thiings.co, www.w3.org

Source & flagged code

4 flagged

scripts/openprd-codex-isolated-worker.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import crypto from 'node:crypto';

4import { spawn, spawnSync } from 'node:child_process';

5import fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

scripts/openprd-codex-isolated-worker.mjsView on unpkg · L3

6import os from 'node:os';

7import path from 'node:path';

8import process from 'node:process';

10const AUTH_FILES = ['auth.json', 'auth-caco.json', 'auth-relay.json'];

11const MAX_AUTOMATIC_CONTINUATIONS = 1;

12const PATCH_MODE_MONITOR_INTERVAL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_MONITOR_INTERVAL_MS, 500);

13const PATCH_MODE_ENTRY_STALL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_ENTRY_STALL_MS, 30000);

14const PATCH_MODE_WRITE_ATTEMPT_STALL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_WRITE_ATTEMPT_STALL_MS, 15000);

15const DEBUG_PATCH_MODE_MONITOR = /^(1|true|yes)$/i.test(String(process.env.OPENPRD_DEBUG_PATCH_MODE || ''));

17function usage() {

18 return [

19 'Usage: node scripts/openprd-codex-isolated-worker.mjs [options]',

20 '',

21 'Options:',

22 ' --cwd <dir> Working directory passed to `codex exec -C`.',

23 ' --prompt <text> Prompt text written to Codex stdin.',

src/self-update.jsView file

Lines 199-239javascript

199 });

200 });

201 child.on('close', (exitCode) => {

202 resolve({

203 ok: exitCode === 0,

204 command,

205 args,

206 display: formatCommand(command, args),

src/learning-review.jsView file

Lines 356-396javascript

356 ...(ws.data.config?.learningReview ?? {}),

357 ...learningReview,

358 },

359 };

360 await writeYaml(ws.paths.config, config);

361

362 const currentState = await readCurrentState(ws);

src/canvas-workspace.jsView file

Lines 5-45javascript

5 * Inputs

6 * Receives a project root plus optional CLI flags such as --thread,

7 * --thread-title, --session, --host, --port, --daemon, --stop, --open,

8 * --

Source & flagged code

4 flagged · loading source

scripts/openprd-codex-isolated-worker.mjsView file

3import crypto from 'node:crypto'; L4: import { spawn, spawnSync } from 'node:child_process'; L5: import fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

scripts/openprd-codex-isolated-worker.mjsView on unpkg · L3

src/self-update.jsView file

219const command = process.platform === 'win32' ? 'where openprd' : 'command -v openprd'; L220: const result = await runProcess(command, [], { shell: true }); L221: const executable = result.stdout.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? null;

High

Shell

Package source references shell execution.

src/self-update.jsView on unpkg · L219

src/learning-review.jsView file

376...ws, L377: data: { L378: ...ws.data, ... L1325: ' assets/', L1326: ' learning-package.json', L1327: ' learning-content.json',

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/learning-review.jsView on unpkg · L376

src/canvas-workspace.jsView file

25Cross-file remote execution chain: src/canvas-workspace.js spawns src/canvas-app.html.js; helper contains network access plus dynamic code execution. L25: import { createReadStream } from 'node:fs'; L26: import http from 'node:http'; L27: import os from 'node:os'; L28: import path from 'node:path'; L29: import { spawn } from 'node:child_process'; L30: import { fileURLToPath } from 'node:url'; ... L87: }); L88: res.end(JSON.stringify(payload, null, 2)); L89: } ... L111: } L112: const text = Buffer.concat(chunks).toString('utf8'); L113: if (!text.trim()) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/canvas-workspace.jsView on unpkg · L25

Findings

3 High2 Medium6 Low

HighChild Processscripts/openprd-codex-isolated-worker.mjs

HighShellsrc/self-update.js

HighCross File Remote Execution Contextsrc/canvas-workspace.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/learning-review.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

scripts/openprd-codex-isolated-worker.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import crypto from 'node:crypto';

4import { spawn, spawnSync } from 'node:child_process';

5import fs from 'node:fs/promises';

High

Child Process

Package source references child process execution.

scripts/openprd-codex-isolated-worker.mjsView on unpkg · L3

6import os from 'node:os';

7import path from 'node:path';

8import process from 'node:process';

10const AUTH_FILES = ['auth.json', 'auth-caco.json', 'auth-relay.json'];

11const MAX_AUTOMATIC_CONTINUATIONS = 1;

12const PATCH_MODE_MONITOR_INTERVAL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_MONITOR_INTERVAL_MS, 500);

13const PATCH_MODE_ENTRY_STALL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_ENTRY_STALL_MS, 30000);

14const PATCH_MODE_WRITE_ATTEMPT_STALL_MS = parsePositiveInt(process.env.OPENPRD_PATCH_MODE_WRITE_ATTEMPT_STALL_MS, 15000);

15const DEBUG_PATCH_MODE_MONITOR = /^(1|true|yes)$/i.test(String(process.env.OPENPRD_DEBUG_PATCH_MODE || ''));

17function usage() {

18 return [

19 'Usage: node scripts/openprd-codex-isolated-worker.mjs [options]',

20 '',

21 'Options:',

22 ' --cwd <dir> Working directory passed to `codex exec -C`.',

23 ' --prompt <text> Prompt text written to Codex stdin.',

src/self-update.jsView file

Lines 199-239javascript

199 });

200 });

201 child.on('close', (exitCode) => {

202 resolve({

203 ok: exitCode === 0,

204 command,

205 args,

206 display: formatCommand(command, args),

src/learning-review.jsView file

Lines 356-396javascript

356 ...(ws.data.config?.learningReview ?? {}),

357 ...learningReview,

358 },

359 };

360 await writeYaml(ws.paths.config, config);

361

362 const currentState = await readCurrentState(ws);

src/canvas-workspace.jsView file

Lines 5-45javascript

5 * Inputs

6 * Receives a project root plus optional CLI flags such as --thread,

7 * --thread-title, --session, --host, --port, --daemon, --stop, --open,

8 * --