registry / @pentoshi/clai / 3.7.2

@pentoshi/clai@3.7.2

A fast, cross-platform AI CLI assistant with ask and agent modes for shell tasks, file operations, and cybersecurity workflows.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 267 file(s), 2.01 MB of source, external domains: agentrouter.org, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, bedrock-mantle.ap-south-1.api.aws, bun.sh, dashscope-intl.aliyuncs.com, example.com, generativelanguage.googleapis.com, github.com, home.qwencloud.com, html.duckduckgo.com, integrate.api.nvidia.com, llm.kimchi.dev, openrouter.ai, router.bynara.id

Source & flagged code

4 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tui/runtime.jsView file

Lines 1-24javascript

1/**

2 * OpenTUI requires Bun's native FFI. Node/tsx cannot initialize the renderer.

3 * Prefer re-exec under Bun when available; otherwise fall back with a clear hint.

4 */

5import { spawnSync } from "node:child_process";

6import { accessSync, constants } from "node:fs";

7import { delimiter, join } from "node:path";

8export

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net from "node:net";

dist/agent/tool-call-parser.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pentoshi/clai@3.5.1 matchedIdentity = npm:QHBlbnRvc2hpL2NsYWk:3.5.1 similarity = 0.375 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/tool-call-parser.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/store/keys.jsView file

34try { L35: const imported = (await import(keychainModuleName)); L36: cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

dist/tui/runtime.jsView file

4*/ L5: import { spawnSync } from "node:child_process"; L6: import { accessSync, constants } from "node:fs"; ... L12: export function findBunExecutable() { L13: const fromEnv = process.env.BUN_INSTALL L14: ? join(process.env.BUN_INSTALL, "bin", process.platform === "win32" ? "bun.exe" : "bun") L15: : undefined; ... L37: " • Dev: npm run dev:bun or bun run src/index.ts", L38: " • Install: https://bun.sh", L39: " • Or: clai --classic (line REPL without OpenTUI)",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tui/runtime.jsView on unpkg · L4

dist/tools/web/ssrf-guard.jsView file

2* SSRF guard — classifies an address (or hostname literal) as L3: * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth L4: * for address classification: `web.fetch` (classifier branch + per-hop ... L7: */ L8: import net from "node:net"; L9: /**

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web/ssrf-guard.jsView on unpkg · L2

dist/agent/tool-call-parser.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/tool-call-parser.jsView on unpkg

Findings

3 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/tui/runtime.js

HighCloud Metadata Accessdist/tools/web/ssrf-guard.js

HighPrevious Version Dangerous Deltadist/agent/tool-call-parser.js

MediumDynamic Requiredist/store/keys.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tui/runtime.jsView file

Lines 1-24javascript

1/**

2 * OpenTUI requires Bun's native FFI. Node/tsx cannot initialize the renderer.

3 * Prefer re-exec under Bun when available; otherwise fall back with a clear hint.

4 */

5import { spawnSync } from "node:child_process";

6import { accessSync, constants } from "node:fs";

7import { delimiter, join } from "node:path";

8export

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net from "node:net";

dist/agent/tool-call-parser.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/tool-call-parser.jsView on unpkg