registry / @ozzylabs/suasor / 0.1.20

@ozzylabs/suasor@0.1.20

A local-first AI secretary that gathers your scattered work context into private memory you and your AI agents can query over MCP. It advises you, and proposes replies, tasks, and decisions, with nothing sent or saved without your approval.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 260 KB of source, external domains: bun.sh, github.com, registry.npmjs.org, slack.com

Oversized source lightweight scan

dist/index.js2.17 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsNativeBindingsHighEntropyStringsUrlStringsbun.shgithub.comregistry.npmjs.orgslack.com

Source & flagged code

4 flagged

package.jsonView file

Lines 16-56json

16 "bun": ">=1.2"

17 },

18 "devDependencies": {

19 "@biomejs/biome": "2.5.0",

20 "@types/bun": "^1.1.0",

21 "drizzle-kit": "^0.31.10",

22 "markdownlint-cli2": "0.22.1",

23 "typescript": "^6.0.0"

24 },

25 "scripts": {

26 "dev": "bun run src/index.ts",

27 "build": "bun build ./src/index.ts --target=bun --outdir=dist --external @slack/web-api --external @microsoft/microsoft-graph-client --external @azure/msal-node --external googleapis --external box-typescript-sdk-gen --external playwright-core --external @napi-rs/keyring",

28 "compile": "bun build ./src/index.ts --compile --outfile=dist/suasor --external @slack/web-api --external @microsoft/microsoft-graph-client --external @azure/msal-node --external googleapis --external box-typescript-sdk-gen --external playwright-core --external @napi-rs/keyring",

29 "typecheck": "tsc --noEmit",

30 "test": "bun test",

31 "test:coverage": "bun scripts/coverage-gate.mjs",

32 "lint": "biome check .",

33 "lint:md": "markdownlint-cli2 \"**/*.md\"",

34 "format": "biome format --write .",

35 "db:generate": "drizzle-kit generate",

36 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/ozzy-labs/suasor.git"

41 },

42 "homepage": "https://github.com/ozzy-labs/suasor",

43 "mcpName": "io.github.ozzy-labs/suasor",

44 "publishConfig": {

45 "access": "public",

46 "provenance": true,

47 "registry": "https://registry.npmjs.org/"

48 },

49 "dependencies": {

50 "@azure/msal-node": "5.2.5",

51 "@microsoft/microsoft-graph-client": "3.0.7",

52 "@modelcontextprotocol/sdk": "1.29.0",

53 "@napi-rs/keyring": "1.3.0",

54 "@slack/web-api": "7.17.0",

55 "box-typescript-sdk-gen": "1.19.1",

56 "clipanion": "4.0.0-rc.4",

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2276163 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2276163 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2276163 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2276163 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Findings

2 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 16-56json

16 "bun": ">=1.2"

17 },

18 "devDependencies": {

19 "@biomejs/biome": "2.5.0",

20 "@types/bun": "^1.1.0",

21 "drizzle-kit": "^0.31.10",

22 "markdownlint-cli2": "0.22.1",

23 "typescript": "^6.0.0"

24 },

25 "scripts": {

26 "dev": "bun run src/index.ts",

29 "typecheck": "tsc --noEmit",

30 "test": "bun test",

31 "test:coverage": "bun scripts/coverage-gate.mjs",

32 "lint": "biome check .",

33 "lint:md": "markdownlint-cli2 \"**/*.md\"",

34 "format": "biome format --write .",

35 "db:generate": "drizzle-kit generate",

36 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/ozzy-labs/suasor.git"

41 },

42 "homepage": "https://github.com/ozzy-labs/suasor",

43 "mcpName": "io.github.ozzy-labs/suasor",

44 "publishConfig": {

45 "access": "public",

46 "provenance": true,

47 "registry": "https://registry.npmjs.org/"

48 },

49 "dependencies": {

50 "@azure/msal-node": "5.2.5",

51 "@microsoft/microsoft-graph-client": "3.0.7",

52 "@modelcontextprotocol/sdk": "1.29.0",

53 "@napi-rs/keyring": "1.3.0",

54 "@slack/web-api": "7.17.0",

55 "box-typescript-sdk-gen": "1.19.1",

56 "clipanion": "4.0.0-rc.4",

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2276163 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2276163 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg