@outputease/toolkit: Clean npm security report (Allow)

Loading npm security reports…

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 416 KB of source, external domains: adoptium.net, api.github.com, apps.apple.com, astral.sh, bun.sh, developer.android.com, git-scm.com, github.com, nodejs.org, opencode.ai, pnpm.io, registry.npmjs.org, rustup.rs, sh.rustup.rs

Source & flagged code

4 flagged

bin/outputease-validate-agents.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

2"use strict";

3require("./_launcher.cjs").main("src/audit/validate-agent-stacks.ts");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/outputease-validate-agents.cjsView on unpkg · L2

src/update/extract.tsView file

Lines 1-21typescript

1import { spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";

4import { tmpdir } from "node:os";

5import { join }

templates/.specify/extensions/git/scripts/bash/create-new-feature-branch.shView file

•path = templates/.[redacted]-new-feature-branch.sh kind = payload_in_excluded_dir sizeBytes = 18542 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.specify/extensions/git/scripts/bash/create-new-feature-branch.shView on unpkg

•path = templates/.[redacted]-new-feature-branch.sh kind = build_helper sizeBytes = 18542 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.specify/extensions/git/scripts/bash/create-new-feature-branch.shView on unpkg

Source & flagged code

4 flagged · loading source

bin/outputease-validate-agents.cjsView file

@outputease/toolkit: Clean npm security report (Allow) | LPM Firewall

@outputease/toolkit@0.3.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code