registry / @ornexus/neocortex / 4.63.14

@ornexus/neocortex@4.63.14

⚠ Under review

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 109 file(s), 981 KB of source, external domains: aka.ms, api.neocortex.sh, neocortex.sh, schemas.microsoft.com, www.apple.com

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

13L14: const { spawn } = require('child_process'); L15: const path = require('path');

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L13

install.jsView file

101/** L102: * Declarative flag mapping: Unix CLI flags -> PowerShell parameters. L103: * To add a new flag, just add an entry here. No switch/case to update.

High

Shell

Package source references shell execution.

install.jsView on unpkg · L101

414L415: const { execSync } = require('child_process'); L416: try { L417: // Run npm install -g silently, capture output L418: execSync('npm install -g @ornexus/neocortex@latest', {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L414

packages/client/dist/continuity/sqlite-store.jsView file

1import{Buffer as z}from"node:buffer";import{createHash as M}from"node:crypto";import{chmodSync as X,existsSync as ye,mkdirSync as Ie}from"node:fs";import{join as Z}from"node:path";... L2: `)).digest("hex")}`,s=r(e),d=r(a);return{receipts:s,outputs:d,aggregate:`sha256:${M("sha256").update(`${t}:${s}:${d}`).digest("hex")}`}}function Xe(t){if(!t)return{};try{const e=JS...

Low

Eval

Package source references a known benign dynamic code generation pattern.

packages/client/dist/continuity/sqlite-store.jsView on unpkg · L1

targets-stubs/lib/mcp-merge.jsView file

6L7: const fs = require('fs'); L8: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

targets-stubs/lib/mcp-merge.jsView on unpkg · L6

packages/client/dist/runner/scheduler.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ornexus/neocortex@4.59.14 matchedIdentity = npm:QG9ybmV4dXMvbmVvY29ydGV4:4.59.14 similarity = 0.645 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/client/dist/runner/scheduler.jsView on unpkg

1import{Buffer as le}from"node:buffer";import{spawnSync as ie}from"node:child_process";import{existsSync as j,mkdirSync as de,readFileSync as me,writeFileSync as pe}from"node:fs";im... L2: `)}function je(e){const r=y(process.execPath);return!r||e.command===r?[e.command,...e.args]:[r,e.command,...e.args]}function Fe(e,r){return["[Unit]",`Description=Run Neocortex Ente... L3: `)}function $e(e,r,t,n){const s=[e.command,...e.args,"tick","--project-root",r,"--scheduled"];return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD... L4: `)}function Be(e,r,t,n){const s=[...e.args,"tick","--project-root",r,"--scheduled"].map(ce).join(" ");return['<?xml version="1.0" encoding="UTF-16"?>','<Task version="1.4" xmlns="h... L5: `)}function Me(e,r,t){const n=[e.command,...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/client/dist/runner/scheduler.jsView on unpkg · L1

packages/client/dist/config/secure-config.jsView file

1import{existsSync as p,readFileSync as U,writeFileSync as R,mkdirSync as S,chmodSync as u}from"node:fs";import{execSync as y}from"node:child_process";import{join as a}from"node:pat... L2: [!] Warning: connected to local server (`+e+`). L3: To use production, run: neocortex activate YOUR-LICENSE-KEY L4: Get yours at https://neocortex.sh/portal/login L5: `))}function F(r){const e=r.match(/^(https?:\/\/)([^/]+)(.*)$/i);if(!e)return null;const[,c,t,n=""]=e;return t.toLowerCase()!==K?null:`${c}api.neocortex.sh${n}`}function Y(){try{if... L6: [!] Machine fingerprint changed (was: ${e.machineId.slice(0,12)}..., now: ${n.slice(0,12)}...).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

packages/client/dist/config/secure-config.jsView on unpkg · L1

targets-stubs/cursor/install-cursor.shView file

•path = targets-stubs/cursor/install-cursor.sh kind = build_helper sizeBytes = 1831 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

targets-stubs/cursor/install-cursor.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code