registry  /  @oyasmi/pipiclaw  /  0.6.9

@oyasmi/pipiclaw@0.6.9

An AI assistant runtime for coding and team workflows, with DingTalk AI Cards, sub-agents, memory, and scheduled events.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
CopyleftLicense
scanned 89 file(s), 522 KB of source, external domains: 127.0.0.1, api.dingtalk.com, api.search.brave.com, api.tavily.com, html.duckduckgo.com, r.jina.ai, s.jina.ai

Source & flagged code

1 flagged · loading source
dist/security/network.jsView file
1import { lookup } from "node:dns/promises"; L2: import { isIP } from "node:net"; ... L14: const BLOCKED_HOSTS = new Set(["localhost", "metadata.google.internal", "metadata", "169.254.169.254"]); L15: const PRIVATE_IPV4_CIDRS = [ L16: "0.0.0.0/8",
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/security/network.jsView on unpkg · L1

Findings

1 High3 Medium6 Low
HighCloud Metadata Accessdist/security/network.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License