registry  /  @panticonic/vibestudio-server  /  0.1.1

@panticonic/vibestudio-server@0.1.1

Vibestudio headless server (build, git, channels, AI, agents) over WebSocket RPC.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1,551 file(s), 15.1 MB of source, external domains: 0.0.0.0, 127.0.0.1, a.com, a.example, accounts.example.com, accounts.example.test, accounts.google.com, acme.example, api-dashboard.search.brave.com, api.acme.test, api.anthropic.com, api.exa.ai, api.example.com, api.example.test, api.github.com, api.mistral.ai, api.openai.com, api.search.brave.com, api.tavily.com, api.test.example, app.local, app.tavily.com, auth.example.com, auth.example.test, auth.openai.com, b.com, b.example, bad.example, bedrock-runtime.us-east-1.amazonaws.com, blocked.example.test, blog.example, brave-example.com, calendar.google.com, chatgpt.com, code.visualstudio.com, dashboard.exa.ai, deno.land, developer.mozilla.org, docs.googleapis.com, electronjs.org, elsewhere.example, elsewhere.test, evil.test, exa-example.com, example.com, example.net, example.org, example.test, fallback.example.com, feeds.arstechnica.com
Oversized source lightweight scan
dist/server.mjs10.3 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsObfuscatedHighEntropyStringsMinifiedUrlStrings127.0.0.1vibestudio.app
vendor/@vibestudio/typecheck/dist/lib/typescript-libs.js2.36 MB file, sampled 256 KB
NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org
vendor/@vibestudio/typecheck/src/lib/typescript-libs.ts2.36 MB file, sampled 256 KB
NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

Source & flagged code

16 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/vendor-install.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
workspace-template/panels/terminal/inputJig.tsxView file
56L57: async exec(): Promise<ShellExecResult> { L58: return { exitCode: 0, stdout: "", stderr: "", durationMs: 0 };
High
Child Process

Package source references child process execution.

workspace-template/panels/terminal/inputJig.tsxView on unpkg · L56
workspace-template/extensions/local-models/index.tsView file
229L230: function execAdapter( L231: cmd: string,
High
Shell

Package source references shell execution.

workspace-template/extensions/local-models/index.tsView on unpkg · L229
workspace-template/extensions/file-tools/index.test.tsView file
97const workspaceRoot = await makeTempRoot(); L98: await fs.writeFile(path.join(workspaceRoot, "script.ts"), "eval({ path: 'tmp/demo.ts' });\n"); L99:
Low
Eval

Package source references a known benign dynamic code generation pattern.

workspace-template/extensions/file-tools/index.test.tsView on unpkg · L97
workspace-template/extensions/image-service/image/photon.tsView file
29L30: const require = createRequire(requireFromUrl); L31: const fs = require("fs") as typeof import("fs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

workspace-template/extensions/image-service/image/photon.tsView on unpkg · L29
workspace-template/packages/browser-data/src/crypto/firefoxCrypto.tsView file
35const algo = params.algorithm === "3des-cbc" ? "des-ede3-cbc" : "aes-256-cbc"; L36: const decipher = crypto.createDecipheriv(algo, params.key, params.iv); L37: decipher.setAutoPadding(false); ... L205: /** L206: * Parse the password-check or nssPrivate ASN.1 blob and derive PBE params. L207: * ... L214: function parsePbeBlob( L215: asn1Data: Buffer, L216: password: string,
Low
Weak Crypto

Package source references weak cryptographic algorithms.

workspace-template/packages/browser-data/src/crypto/firefoxCrypto.tsView on unpkg · L35
dist/cli/client.mjsView file
1#!/usr/bin/env node L2: var Ll=Object.defineProperty;var ps=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u"... L3: `)}Nn();Ks();function Yp(){return typeof globalThis.crypto?.randomUUID=="function"?globalThis.crypto.randomUUID():`${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/client.mjsView on unpkg · L1
1#!/usr/bin/env node L2: var Ll=Object.defineProperty;var ps=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u"... L3: `)}Nn();Ks();function Yp(){return typeof globalThis.crypto?.randomUUID=="function"?globalThis.crypto.randomUUID():`${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/client.mjsView on unpkg · L1
workspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView file
•path = workspace-template/panels/terminal/vscode-[redacted].PowerShell.Pager.dll kind = native_binary sizeBytes = 16784 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

workspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView on unpkg
workspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView file
•path = workspace-template/panels/terminal/vscode-[redacted]-rc.zsh kind = build_helper sizeBytes = 10424 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

workspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView on unpkg
dist/server.mjsView file
•path = dist/server.mjs kind = oversized_source_file sizeBytes = 10784043 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.mjsView on unpkg
•path = dist/server.mjs kind = oversized_cli_entrypoint sizeBytes = 10784043 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.mjsView on unpkg
workspace-template/extensions/browser-data/references/PASSWORDS.mdView file
93patternName = generic_password severity = medium line = 93 matchedText = {reveale...••"}
Medium
Secret Pattern

Hardcoded password in workspace-template/extensions/browser-data/references/PASSWORDS.md

workspace-template/extensions/browser-data/references/PASSWORDS.mdView on unpkg · L93
workspace-template/packages/browser-data/src/__tests__/export.test.tsView file
50patternName = generic_password severity = medium line = 50 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in workspace-template/packages/browser-data/src/__tests__/export.test.ts

workspace-template/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L50
56patternName = generic_password severity = medium line = 56 matchedText = password...ne",
Medium
Secret Pattern

Hardcoded password in workspace-template/packages/browser-data/src/__tests__/export.test.ts

workspace-template/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L56
61patternName = generic_password severity = medium line = 61 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in workspace-template/packages/browser-data/src/__tests__/export.test.ts

workspace-template/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L61

Findings

6 High11 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processworkspace-template/panels/terminal/inputJig.tsx
HighShellworkspace-template/extensions/local-models/index.ts
HighSame File Env Network Executiondist/cli/client.mjs
HighCommand Output Exfiltrationdist/cli/client.mjs
HighOversized Source Filedist/server.mjs
MediumDynamic Requireworkspace-template/extensions/image-service/image/photon.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryworkspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dll
MediumShips Build Helperworkspace-template/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zsh
MediumOversized Cli Entrypointdist/server.mjs
MediumStructural Risk Force Deep Review
MediumSecret Patternworkspace-template/extensions/browser-data/references/PASSWORDS.md
MediumSecret Patternworkspace-template/packages/browser-data/src/__tests__/export.test.ts
MediumSecret Patternworkspace-template/packages/browser-data/src/__tests__/export.test.ts
MediumSecret Patternworkspace-template/packages/browser-data/src/__tests__/export.test.ts
LowScripts Present
LowEvalworkspace-template/extensions/file-tools/index.test.ts
LowWeak Cryptoworkspace-template/packages/browser-data/src/crypto/firefoxCrypto.ts
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings