registry  /  @ornexus/neocortex  /  4.59.14

@ornexus/neocortex@4.59.14

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 79 file(s), 384 KB of source, external domains: aka.ms, api.neocortex.sh, neocortex.sh, schemas.microsoft.com, www.apple.com

Source & flagged code

10 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
postinstall.jsView file
13L14: const { spawn } = require('child_process'); L15: const path = require('path');
High
Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13
install.jsView file
101/** L102: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L103: * To add a new flag, just add an entry here. No switch/case to update.
High
Shell

Package source references shell execution.

install.jsView on unpkg · L101
414L415: const { execSync } = require('child_process'); L416: try { L417: // Run npm install -g silently, capture output L418: execSync('npm install -g @ornexus/neocortex@latest', {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L414
packages/client/dist/continuity/sqlite-store.jsView file
1import{Buffer as S}from"node:buffer";import{createHash as T}from"node:crypto";import{chmodSync as C,existsSync as q,mkdirSync as D}from"node:fs";import{join as O}from"node:path";im... L2: INSERT OR IGNORE INTO jobs (
Low
Eval

Package source references a known benign dynamic code generation pattern.

packages/client/dist/continuity/sqlite-store.jsView on unpkg · L1
targets-stubs/lib/mcp-merge.jsView file
6L7: const fs = require('fs'); L8: const path = require('path');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/mcp-merge.jsView on unpkg · L6
packages/client/dist/runner/scheduler.jsView file
1import{Buffer as le}from"node:buffer";import{spawnSync as ie}from"node:child_process";import{createHash as de}from"node:crypto";import{existsSync as j,mkdirSync as me,readFileSync ... L2: `)}function Fe(e){const r=y(process.execPath);return!r||e.command===r?[e.command,...e.args]:[r,e.command,...e.args]}function Be(e,r){return["[Unit]",`Description=Run Neocortex Ente... L3: `)}function Me(e,r,t,n){const s=[e.command,...e.args,"tick","--project-root",r,"--scheduled"];return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD... L4: `)}function He(e,r,t,n){const s=[...e.args,"tick","--project-root",r,"--scheduled"].map(ce).join(" ");return['<?xml version="1.0" encoding="UTF-16"?>','<Task version="1.4" xmlns="h... L5: `)}function Ke(e,r,t){const n=[e.command,...e.args,"tick","--project-root",r,"--scheduled"].map(G).join(" ");return[t.cronMarkerStart,`# neocortex-runner user-scope cron fallback f...
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/client/dist/runner/scheduler.jsView on unpkg · L1
packages/client/dist/config/secure-config.jsView file
1import{existsSync as p,readFileSync as U,writeFileSync as R,mkdirSync as S,chmodSync as u}from"node:fs";import{execSync as y}from"node:child_process";import{join as a}from"node:pat... L2: [!] Warning: connected to local server (`+e+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function F(r){const e=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!e)return null;const[,c,t,n=""]=e;return t.toLowerCase()!==K?null:`${c}api.neocortex.sh${n}`}function Y(){try{if... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${n.slice(0,12)}...).
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1
targets-stubs/cursor/install-cursor.shView file
•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1831 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Findings

5 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpostinstall.js
HighShellinstall.js
HighSandbox Evasion Gated Capabilitypackages/client/dist/config/secure-config.js
HighRuntime Package Installinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiretargets-stubs/lib/mcp-merge.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencepackages/client/dist/runner/scheduler.js
MediumShips Build Helpertargets-stubs/cursor/install-cursor.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalpackages/client/dist/continuity/sqlite-store.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings