Static Scan Results
scanned 21h ago · by rust-scannerStatic analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
375if (answer === 'now') {
L376: const { spawnSync } = await import('child_process');
L377: let spinner = ora('Resolving package metadata...').start();
High
dist/lib/exec.jsView file
503// createVersionedAlias — a bash alias next to it would shadow the `.cmd` in
L504: // cmd.exe/PowerShell name resolution); the extensionless existsSync branch
L505: // below still matches a legacy install's bash alias. When no shim exists on
High
dist/lib/sqlite.jsView file
14const isBun = typeof globalThis.Bun !== 'undefined';
L15: const require = createRequire(import.meta.url);
L16: // Keep Node on createRequire() so Vitest doesn't try to prebundle the built-in
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/lib/sqlite.jsView on unpkg · L14dist/lib/platform/ipc.jsView file
12* touching disk, and never probe the result with fs.existsSync (it always reports
L13: * false). Both forms are accepted by net.createServer / net.createConnection.
L14: */
L15: export function ipcEndpoint(socketPath, platform = process.platform) {
L16: if (platform === 'win32') {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/lib/platform/ipc.jsView on unpkg · L12dist/lib/agents.jsView file
10*/
L11: import { execFile } from 'child_process';
L12: import { promisify } from 'util';
...
L24: const execFileAsync = promisify(execFile);
L25: const HOME = os.homedir();
L26: /**
...
L39: try {
L40: cliVersionCache = JSON.parse(fs.readFileSync(CLI_VERSION_CACHE_PATH, 'utf-8'));
L41: }
...
L71: export function findInPath(command) {
L72: const pathEnv = process.env.PATH || '';
L73: const pathExt = process.platform === 'win32' ? (process.env.PATHEXT || '').split(';') : [''];
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/agents.jsView on unpkg · L10dist/lib/cli-resources.jsView file
356assertNpmPackage(method.npm);
L357: const r = spawnSync('npm', ['install', '-g', method.npm], { stdio: 'inherit' });
L358: if (r.status !== 0) {
L359: throw new Error(`npm install -g ${method.npm} exited with status ${r.status ?? 'unknown'}`);
L360: }
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/lib/cli-resources.jsView on unpkg · L356dist/lib/menubar/MenubarHelper.app/Contents/MacOS/MenubarHelperView file
•path = dist/lib/menubar/MenubarHelper.[redacted]
kind = native_binary
sizeBytes = 650032
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
dist/lib/menubar/MenubarHelper.app/Contents/MacOS/MenubarHelperView on unpkgFindings
4 High7 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/lib/exec.js
HighRuntime Package Installdist/lib/cli-resources.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/lib/sqlite.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/agents.js
MediumShips Native Binarydist/lib/menubar/MenubarHelper.app/Contents/MacOS/MenubarHelper
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/lib/platform/ipc.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings