registry / @panticonic/vibestudio / 0.1.0

@panticonic/vibestudio@0.1.0

A horizontally stacked panel app built with Electron and TypeScript

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,862 file(s), 19.0 MB of source, external domains: 0.0.0.0, 127.0.0.1, a.com, a.example, accounts.example.com, accounts.example.test, accounts.google.com, acme.example, api-dashboard.search.brave.com, api.acme.test, api.anthropic.com, api.exa.ai, api.example.com, api.example.test, api.github.com, api.mistral.ai, api.openai.com, api.search.brave.com, api.tavily.com, api.test.example, app.local, app.tavily.com, auth.example.com, auth.example.test, auth.openai.com, b.com, b.example, bad.example, bedrock-runtime.us-east-1.amazonaws.com, blocked.example.test, blog.example, brave-example.com, calendar.google.com, chatgpt.com, code.visualstudio.com, dashboard.exa.ai, deno.land, developer.mozilla.org, docs.googleapis.com, easylist.to, electronjs.org, elsewhere.example, elsewhere.test, evil.test, exa-example.com, example.com, example.net, example.org, example.test, fallback.example.com

Oversized source lightweight scan

dist/main.cjs2.20 MB file, sampled 256 KB

FilesystemEnvironmentVarsObfuscatedHighEntropyStringsMinifiedUrlStrings127.0.0.1easylist.toraw.githubusercontent.comsecure.fanboy.co.nzvibestudio.app

dist/server-electron.cjs10.3 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStrings127.0.0.1vibestudio.app

dist/server.mjs10.3 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsObfuscatedHighEntropyStringsMinifiedUrlStrings127.0.0.1vibestudio.app

packages/typecheck/dist/lib/typescript-libs.js2.36 MB file, sampled 256 KB

NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

packages/typecheck/src/lib/typescript-libs.ts2.36 MB file, sampled 256 KB

NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

vendor/@vibestudio/typecheck/dist/lib/typescript-libs.js2.36 MB file, sampled 256 KB

NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

vendor/@vibestudio/typecheck/src/lib/typescript-libs.ts2.36 MB file, sampled 256 KB

NetworkChildProcessEvalMinifiedUrlStringsdeveloper.mozilla.orgwww.apache.org

Source & flagged code

17 flagged

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "license": "MIT",

8 "main": "dist/main.cjs",

9 "bin": {

10 "vibestudio": "scripts/vibestudio-launcher.mjs",

11 "vibestudio-server": "scripts/vibestudio-server-shim.mjs"

12 },

13 "engines": {

14 "node": ">=22.13.0"

15 },

16 "files": [

17 "dist",

18 "vendor",

19 "workspace",

20 "packages",

21 "patches",

22 "scripts",

23 "build-resources"

24 ],

25 "scripts": {

26 "postinstall": "node scripts/vendor-install.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "@dnd-kit/core": "^6.3.1",

30 "@dnd-kit/sortable": "^10.0.0",

31 "@dnd-kit/utilities": "^3.2.2",

32 "@earendil-works/pi-ai": "^0.78.0",

33 "@ghostery/adblocker": "^2.13.4",

34 "@modelcontextprotocol/sdk": "^1.12.1",

35 "@npmcli/arborist": "^7.4.0",

36 "@radix-ui/react-icons": "^1.3.2",

37 "@radix-ui/themes": "^3.2.1",

38 "@silvia-odwyer/photon-node": "^0.3.4",

39 "@tanstack/react-virtual": "^3.13.0",

40 "@types/json-schema": "^7.0.15",

41 "@types/ws": "^8.18.1",

42 "@xterm/addon-clipboard": "^0.2.0",

43 "@xterm/addon-fit": "^0.11.0",

44 "@xterm/addon-image": "^0.9.0",

45 "@xterm/addon-ligatures": "^0.10.0",

46 "@xterm/addon-progress": "^0.2.0",

dist/cli/client.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var Ll=Object.defineProperty;var ps=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]})

workspace/extensions/local-models/index.tsView file

Lines 209-249typescript

209

210function defaultRootDir(): string {

211 const override = process.env["VIBESTUDIO_LOCAL_MODELS_DIR"];

212 if (override && override.trim()) return override.trim();

213 // Machine-global by design (§4.3): models/engines are hardware assets, not

workspace/extensions/file-tools/index.test.tsView file

Lines 77-117typescript

77 getInfo: async () => ({

78 path: workspaceRoot,

79 contextsPath: path.join(workspaceRoot, ".contexts"),

80 }),

81 },

82 fs: { realpath: async () => workspaceRoot },

dist/browserPreload.cjsView file

Lines 1-2javascript

1"use strict";var i=require("electron");function o(){i.contextBridge.exposeInMainWorld("__vibestudio_autofill",{ping:()=>i.ipcRenderer.send("vibestudio:autofill:ping")})}o();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserPreload.cjsView on unpkg · L1

workspace/packages/browser-data/src/crypto/firefoxCrypto.tsView file

Lines 15-55typescript

16// Well-known OIDs

17const OID_PBES2 = "1.2.840.113549.1.5.13";

18const OID_PBKDF2 = "1.2.840.113549.1.5.12";

19const OID_PBE_SHA1_3DES = "1.2.840.113549.1.12.5.1.3";

20const

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView file

•path = [redacted]-[redacted].PowerShell.Pager.dll kind = native_binary sizeBytes = 16784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView on unpkg

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView file

•path = [redacted]-[redacted]-rc.zsh kind = build_helper sizeBytes = 10424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView on unpkg

dist/assets/brand/favicon.icoView file

•path = dist/assets/brand/favicon.ico kind = high_entropy_blob sizeBytes = 10246 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/brand/favicon.icoView on unpkg

dist/server-electron.cjsView file

•path = dist/server-electron.cjs kind = oversized_source_file sizeBytes = 10785986 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-electron.cjsView on unpkg

dist/server.mjsView file

•path = dist/server.mjs kind = oversized_cli_entrypoint sizeBytes = 10784043 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.mjsView on unpkg

workspace/extensions/browser-data/references/PASSWORDS.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = {reveale...••"}

Medium

Secret Pattern

Hardcoded password in workspace/extensions/browser-data/references/PASSWORDS.md

workspace/extensions/browser-data/references/PASSWORDS.mdView on unpkg · L93

workspace/packages/browser-data/src/__tests__/export.test.tsView file

50patternName = generic_password severity = medium line = 50 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L50

56patternName = generic_password severity = medium line = 56 matchedText = password...ne",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L56

61patternName = generic_password severity = medium line = 61 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L61

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/vendor-install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/client.mjsView file

1#!/usr/bin/env node L2: var Ll=Object.defineProperty;var ps=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u"... L3: `)}Nn();Ks();function Yp(){return typeof globalThis.crypto?.randomUUID=="function"?globalThis.crypto.randomUUID():`${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}...

High

Child Process

Package source references child process execution.

dist/cli/client.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/client.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/client.mjsView on unpkg · L1

workspace/extensions/local-models/index.tsView file

229L230: function execAdapter( L231: cmd: string,

High

Shell

Package source references shell execution.

workspace/extensions/local-models/index.tsView on unpkg · L229

workspace/extensions/file-tools/index.test.tsView file

97const workspaceRoot = await makeTempRoot(); L98: await fs.writeFile(path.join(workspaceRoot, "script.ts"), "eval({ path: 'tmp/demo.ts' });\n"); L99:

Low

Eval

Package source references a known benign dynamic code generation pattern.

workspace/extensions/file-tools/index.test.tsView on unpkg · L97

dist/browserPreload.cjsView file

1"use strict";var i=require("electron");function o(){i.contextBridge.exposeInMainWorld("__vibestudio_autofill",{ping:()=>i.ipcRenderer.send("vibestudio:autofill:ping")})}o();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserPreload.cjsView on unpkg · L1

workspace/packages/browser-data/src/crypto/firefoxCrypto.tsView file

35const algo = params.algorithm === "3des-cbc" ? "des-ede3-cbc" : "aes-256-cbc"; L36: const decipher = crypto.createDecipheriv(algo, params.key, params.iv); L37: decipher.setAutoPadding(false); ... L205: /** L206: * Parse the password-check or nssPrivate ASN.1 blob and derive PBE params. L207: * ... L214: function parsePbeBlob( L215: asn1Data: Buffer, L216: password: string,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

workspace/packages/browser-data/src/crypto/firefoxCrypto.tsView on unpkg · L35

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView file

•path = [redacted]-[redacted].PowerShell.Pager.dll kind = native_binary sizeBytes = 16784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView on unpkg

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView file

•path = [redacted]-[redacted]-rc.zsh kind = build_helper sizeBytes = 10424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView on unpkg

dist/assets/brand/favicon.icoView file

•path = dist/assets/brand/favicon.ico kind = high_entropy_blob sizeBytes = 10246 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/brand/favicon.icoView on unpkg

dist/server-electron.cjsView file

•path = dist/server-electron.cjs kind = oversized_source_file sizeBytes = 10785986 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-electron.cjsView on unpkg

dist/server.mjsView file

•path = dist/server.mjs kind = oversized_cli_entrypoint sizeBytes = 10784043 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.mjsView on unpkg

workspace/extensions/browser-data/references/PASSWORDS.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = {reveale...••"}

Medium

Secret Pattern

Hardcoded password in workspace/extensions/browser-data/references/PASSWORDS.md

workspace/extensions/browser-data/references/PASSWORDS.mdView on unpkg · L93

workspace/packages/browser-data/src/__tests__/export.test.tsView file

50patternName = generic_password severity = medium line = 50 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L50

56patternName = generic_password severity = medium line = 56 matchedText = password...ne",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L56

61patternName = generic_password severity = medium line = 61 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L61

Findings

7 High11 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/client.mjs

HighShellworkspace/extensions/local-models/index.ts

HighSame File Env Network Executiondist/cli/client.mjs

HighCommand Output Exfiltrationdist/cli/client.mjs

HighShips High Entropy Blobdist/assets/brand/favicon.ico

HighOversized Source Filedist/server-electron.cjs

MediumDynamic Requiredist/browserPreload.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryworkspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dll

MediumShips Build Helperworkspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zsh

MediumOversized Cli Entrypointdist/server.mjs

MediumStructural Risk Force Deep Review

MediumSecret Patternworkspace/extensions/browser-data/references/PASSWORDS.md

MediumSecret Patternworkspace/packages/browser-data/src/__tests__/export.test.ts

LowScripts Present

LowEvalworkspace/extensions/file-tools/index.test.ts

LowWeak Cryptoworkspace/packages/browser-data/src/crypto/firefoxCrypto.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

17 flagged

package.jsonView file

Lines 6-46json

6 "type": "module",

7 "license": "MIT",

8 "main": "dist/main.cjs",

9 "bin": {

10 "vibestudio": "scripts/vibestudio-launcher.mjs",

11 "vibestudio-server": "scripts/vibestudio-server-shim.mjs"

12 },

13 "engines": {

14 "node": ">=22.13.0"

15 },

16 "files": [

17 "dist",

18 "vendor",

19 "workspace",

20 "packages",

21 "patches",

22 "scripts",

23 "build-resources"

24 ],

25 "scripts": {

26 "postinstall": "node scripts/vendor-install.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "@dnd-kit/core": "^6.3.1",

30 "@dnd-kit/sortable": "^10.0.0",

31 "@dnd-kit/utilities": "^3.2.2",

32 "@earendil-works/pi-ai": "^0.78.0",

33 "@ghostery/adblocker": "^2.13.4",

34 "@modelcontextprotocol/sdk": "^1.12.1",

35 "@npmcli/arborist": "^7.4.0",

36 "@radix-ui/react-icons": "^1.3.2",

37 "@radix-ui/themes": "^3.2.1",

38 "@silvia-odwyer/photon-node": "^0.3.4",

39 "@tanstack/react-virtual": "^3.13.0",

40 "@types/json-schema": "^7.0.15",

41 "@types/ws": "^8.18.1",

42 "@xterm/addon-clipboard": "^0.2.0",

43 "@xterm/addon-fit": "^0.11.0",

44 "@xterm/addon-image": "^0.9.0",

45 "@xterm/addon-ligatures": "^0.10.0",

46 "@xterm/addon-progress": "^0.2.0",

dist/cli/client.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var Ll=Object.defineProperty;var ps=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]})

workspace/extensions/local-models/index.tsView file

Lines 209-249typescript

209

210function defaultRootDir(): string {

211 const override = process.env["VIBESTUDIO_LOCAL_MODELS_DIR"];

212 if (override && override.trim()) return override.trim();

213 // Machine-global by design (§4.3): models/engines are hardware assets, not

workspace/extensions/file-tools/index.test.tsView file

Lines 77-117typescript

77 getInfo: async () => ({

78 path: workspaceRoot,

79 contextsPath: path.join(workspaceRoot, ".contexts"),

80 }),

81 },

82 fs: { realpath: async () => workspaceRoot },

dist/browserPreload.cjsView file

Lines 1-2javascript

1"use strict";var i=require("electron");function o(){i.contextBridge.exposeInMainWorld("__vibestudio_autofill",{ping:()=>i.ipcRenderer.send("vibestudio:autofill:ping")})}o();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/browserPreload.cjsView on unpkg · L1

workspace/packages/browser-data/src/crypto/firefoxCrypto.tsView file

Lines 15-55typescript

16// Well-known OIDs

17const OID_PBES2 = "1.2.840.113549.1.5.13";

18const OID_PBKDF2 = "1.2.840.113549.1.5.12";

19const OID_PBE_SHA1_3DES = "1.2.840.113549.1.12.5.1.3";

20const

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView file

•path = [redacted]-[redacted].PowerShell.Pager.dll kind = native_binary sizeBytes = 16784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/psreadline/Microsoft.PowerShell.Pager.dllView on unpkg

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView file

•path = [redacted]-[redacted]-rc.zsh kind = build_helper sizeBytes = 10424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

workspace/panels/terminal/vscode-upstream/src/vs/workbench/contrib/terminal/common/scripts/shellIntegration-rc.zshView on unpkg

dist/assets/brand/favicon.icoView file

•path = dist/assets/brand/favicon.ico kind = high_entropy_blob sizeBytes = 10246 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/brand/favicon.icoView on unpkg

dist/server-electron.cjsView file

•path = dist/server-electron.cjs kind = oversized_source_file sizeBytes = 10785986 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-electron.cjsView on unpkg

dist/server.mjsView file

•path = dist/server.mjs kind = oversized_cli_entrypoint sizeBytes = 10784043 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.mjsView on unpkg

workspace/extensions/browser-data/references/PASSWORDS.mdView file

93patternName = generic_password severity = medium line = 93 matchedText = {reveale...••"}

Medium

Secret Pattern

Hardcoded password in workspace/extensions/browser-data/references/PASSWORDS.md

workspace/extensions/browser-data/references/PASSWORDS.mdView on unpkg · L93

workspace/packages/browser-data/src/__tests__/export.test.tsView file

50patternName = generic_password severity = medium line = 50 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L50

56patternName = generic_password severity = medium line = 56 matchedText = password...ne",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L56

61patternName = generic_password severity = medium line = 61 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in workspace/packages/browser-data/src/__tests__/export.test.ts

workspace/packages/browser-data/src/__tests__/export.test.tsView on unpkg · L61