registry / @paparats/cli / 1.7.4

@paparats/cli@1.7.4

CLI for Paparats MCP - semantic code search with AST chunking, symbol graph, and vector search for AI coding assistants

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 157 KB of source, external domains: docker.com, docs.docker.com, host.docker.internal, huggingface.co, www.apple.com, www.yamllint.com

Source & flagged code

5 flagged

dist/commands/edit.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawnSync } from 'child_process';

3import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/edit.jsView on unpkg · L1

4import path from 'path';

5import chalk from 'chalk';

6import { PAPARATS_HOME, COMPOSE_YML, PROJECTS_YML, resolveProjectsFilePath, readProjectsFile, } from '../projects-yml.js';

7export function defaultResolveEditor(platform) {

8 const visual = process.env['VISUAL'];

9 if (visual)

10 return splitCmd(visual);

11 const editor = process.env['EDITOR'];

12 if (editor)

13 return splitCmd(editor);

14 if (platform === 'darwin')

15 return { cmd: 'open', args: ['-t', '-W'] };

16 if (platform === 'win32')

17 return { cmd: 'notepad', args: [] };

18 return { cmd: 'xdg-open', args: [] };

19}

20function splitCmd(value) {

21 const parts = value.trim().split(/\s+/);

dist/commands/install.jsView file

Lines 1-24javascript

1import { Command } from 'commander';

2import fs from 'fs';

3import path from 'path';

4import os from 'os';

5import { execSync, spawn } from 'child_process';

6import

dist/commands/doctor.jsView file

Lines 5-45javascript

5import os from 'os';

6import chalk from 'chalk';

7import ora from 'ora';

8import { findConfigDir, readConfig, CONFIG_FILE } from '../config.js';

9import { ApiClient } from '../api-client.js';

dist/commands/update.jsView file

Lines 152-192javascript

152 return { refresh: true, reason: 'no embedMode; macOS host without docker-compose.yml' };

153 }

154 return { refresh: false, reason: 'no embedMode; no native-embed signals detected' };

155}

156export async function runUpdate(opts, deps) {

157

Source & flagged code

5 flagged · loading source

dist/commands/edit.jsView file

1import { Command } from 'commander'; L2: import { spawnSync } from 'child_process'; L3: import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/edit.jsView on unpkg · L1

dist/commands/install.jsView file

4import os from 'os'; L5: import { execSync, spawn } from 'child_process'; L6: import chalk from 'chalk'; ... L17: const CODE_MODEL_NAME = 'jina-code-embeddings'; L18: const CODE_GGUF_URL = 'https://huggingface.co/jinaai/jina-code-embeddings-1.5b-GGUF/resolve/main/jina-code-embeddings-1.5b-Q8_0.gguf'; L19: const CODE_GGUF_FILE = path.join(MODELS_DIR, 'jina-code-embeddings-1.5b-Q8_0.gguf'); ... L24: try { L25: const command = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`; L26: execSync(command, { stdio: 'ignore', timeout: 3000 }); ... L101: } L102: const buffer = await response.arrayBuffer(); L103: fs.writeFileSync(dest, Buffer.from(buffer));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/install.jsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/install.jsView on unpkg · L4

dist/commands/doctor.jsView file

25try { L26: execSync('docker compose version', { stdio: 'ignore', timeout: 3000 }); L27: return true; ... L37: // Resolve config for URLs/models L38: const qdrantUrl = process.env.QDRANT_URL ?? 'http://localhost:6333'; L39: const embedUrl = process.env.EMBED_URL ?? 'http://localhost:11434';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/doctor.jsView on unpkg · L25

dist/commands/update.jsView file

172try { L173: exec(`npm install -g ${NPM_PACKAGE}@latest`, { L174: stdio: opts.verbose ? 'inherit' : ['pipe', 'pipe', 'pipe'],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L172

Findings

5 High4 Medium5 Low

HighChild Processdist/commands/edit.js

HighShell

HighSame File Env Network Executiondist/commands/doctor.js

HighSandbox Evasion Gated Capabilitydist/commands/install.js

HighRuntime Package Installdist/commands/update.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/install.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/commands/edit.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawnSync } from 'child_process';

3import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/edit.jsView on unpkg · L1

4import path from 'path';

5import chalk from 'chalk';

6import { PAPARATS_HOME, COMPOSE_YML, PROJECTS_YML, resolveProjectsFilePath, readProjectsFile, } from '../projects-yml.js';

7export function defaultResolveEditor(platform) {

8 const visual = process.env['VISUAL'];

9 if (visual)

10 return splitCmd(visual);

11 const editor = process.env['EDITOR'];

12 if (editor)

13 return splitCmd(editor);

14 if (platform === 'darwin')

15 return { cmd: 'open', args: ['-t', '-W'] };

16 if (platform === 'win32')

17 return { cmd: 'notepad', args: [] };

18 return { cmd: 'xdg-open', args: [] };

19}

20function splitCmd(value) {

21 const parts = value.trim().split(/\s+/);

dist/commands/install.jsView file

Lines 1-24javascript

1import { Command } from 'commander';

2import fs from 'fs';

3import path from 'path';

4import os from 'os';

5import { execSync, spawn } from 'child_process';

6import

dist/commands/doctor.jsView file

Lines 5-45javascript

5import os from 'os';

6import chalk from 'chalk';

7import ora from 'ora';

8import { findConfigDir, readConfig, CONFIG_FILE } from '../config.js';

9import { ApiClient } from '../api-client.js';

dist/commands/update.jsView file

Lines 152-192javascript

152 return { refresh: true, reason: 'no embedMode; macOS host without docker-compose.yml' };

153 }

154 return { refresh: false, reason: 'no embedMode; no native-embed signals detected' };

155}

156export async function runUpdate(opts, deps) {

157