Static Scan Results
scanned 10d ago · by rust-scannerStatic analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
13L14: const { spawn } = require('child_process');
L15: const path = require('path');
High
install.jsView file
101/**
L102: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters.
L103: * To add a new flag, just add an entry here. No switch/case to update.
High
414L415: const { execSync } = require('child_process');
L416: try {
L417: // Run npm install -g silently, capture output
L418: execSync('npm install -g @ornexus/neocortex@latest', {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
install.jsView on unpkg · L414packages/client/dist/continuity/sqlite-store.jsView file
1import{Buffer as R}from"node:buffer";import{createHash as L}from"node:crypto";import{chmodSync as M,existsSync as B,mkdirSync as J}from"node:fs";import{join as w}from"node:path";im...
L2: INSERT OR IGNORE INTO jobs (
Low
Eval
Package source references a known benign dynamic code generation pattern.
packages/client/dist/continuity/sqlite-store.jsView on unpkg · L1targets-stubs/lib/mcp-merge.jsView file
6L7: const fs = require('fs');
L8: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
targets-stubs/lib/mcp-merge.jsView on unpkg · L6packages/client/dist/runner/scheduler.jsView file
1import{Buffer as le}from"node:buffer";import{spawnSync as ie}from"node:child_process";import{createHash as de}from"node:crypto";import{existsSync as j,mkdirSync as me,readFileSync ...
L2: `)}function Fe(e){const r=y(process.execPath);return!r||e.command===r?[e.command,...e.args]:[r,e.command,...e.args]}function Be(e,r){return["[Unit]",`Description=Run Neocortex Ente...
L3: `)}function Me(e,r,t,n){const s=[e.command,...e.args,"tick","--project-root",r,"--scheduled"];return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD...
L4: `)}function He(e,r,t,n){const s=[...e.args,"tick","--project-root",r,"--scheduled"].map(ce).join(" ");return['<?xml version="1.0" encoding="UTF-16"?>','<Task version="1.4" xmlns="h...
L5: `)}function Ke(e,r,t){const n=[e.command,...e.args,"tick","--project-root",r,"--scheduled"].map(G).join(" ");return[t.cronMarkerStart,`# neocortex-runner user-scope cron fallback f...
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
packages/client/dist/runner/scheduler.jsView on unpkg · L1packages/client/dist/config/secure-config.jsView file
1import{existsSync as p,readFileSync as U,writeFileSync as R,mkdirSync as S,chmodSync as u}from"node:fs";import{execSync as y}from"node:child_process";import{join as a}from"node:pat...
L2: [!] Warning: connected to local server (`+e+`).
L3: To use production, run: neocortex activate YOUR-LICENSE-KEY
L4: Get yours at https://neocortex.sh/portal/login
L5: `))}function F(r){const e=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!e)return null;const[,c,t,n=""]=e;return t.toLowerCase()!==K?null:`${c}api.neocortex.sh${n}`}function Y(){try{if...
L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${n.slice(0,12)}...).
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
packages/client/dist/config/secure-config.jsView on unpkg · L1targets-stubs/cursor/install-cursor.shView file
•path = targets-stubs/cursor/install-cursor.sh
kind = build_helper
sizeBytes = 1831
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
targets-stubs/cursor/install-cursor.shView on unpkgpackages/client/dist/commands/invoke.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @ornexus/neocortex@4.59.14
matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.59.14
similarity = 0.908
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/client/dist/commands/invoke.jsView on unpkgFindings
1 Critical5 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltapackages/client/dist/commands/invoke.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpostinstall.js
HighShellinstall.js
HighSandbox Evasion Gated Capabilitypackages/client/dist/config/secure-config.js
HighRuntime Package Installinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiretargets-stubs/lib/mcp-merge.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencepackages/client/dist/runner/scheduler.js
MediumShips Build Helpertargets-stubs/cursor/install-cursor.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalpackages/client/dist/continuity/sqlite-store.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings