registry / @pieai/pro-gov / 0.4.9

@pieai/pro-gov@0.4.9

Project-level distribution kit for Project Governance System.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 393 KB of source, external domains: react.dev, www.w3.org

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 41-87javascript

41 return files.sort();

42}

43function toUnixPath(path) {

44 return path.replaceAll("\\", "/");

45}

46function isPlatformMetadata(name) {

47 return name === ".DS_Store" || name === "Thumbs.db" || name.startsWith("._");

48}

50// src/commands/assets.ts

51import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";

52import { dirname as dirname5, join as join11 } from "node:path";

54// src/asset-bundles/bundles.ts

55import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync } from "node:fs";

56import { join as join2 } from "node:path";

57function loadAgentAssetBundles(agentAssetsDir) {

58 const bundlesDir = join2(agentAssetsDir, "bundles");

59 if (!existsSync2(bundlesDir)) return [];

60 return readdirSync2(bundlesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => {

61 const bundlePath = join2(bundlesDir, entry.name);

62 return JSON.parse(readFileSync(bundlePath, "utf8"));

63 }).sort((a, b) => a.id.localeCompare(b.id));

64}

66// src/asset-npx/maintenance.ts

67import { createHash } from "node:crypto";

68import { spawnSync } from "node:child_process";

69import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L61

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L67

70import { join as join3, relative as relative2 } from "node:path";

71import { tmpdir } from "node:os";

72function createNpxSkillsMaintenancePlan(options) {

73 assertNativeNpxRoot(options.npxRoot);

74 if (options.operation === "add" && !options.source) {

75 throw new Error("npx skills add requires a source.");

76 }

77 const before = snapshotFiles(options.npxRoot);

78 const tempRoot = mkdtempSync(join3(tmpdir(), "pro-gov-npx-skills-"));

79 cpSync(options.npxRoot, tempRoot, { recursive: true, dereference: false });

80 const command2 = buildNpxCommand(options);

81 const runner = options.runner ?? defaultRunner;

82 const timeoutMs = options.timeoutMs ?? 3e5;

83 const result = runner({ command: command2, cwd: tempRoot, timeoutMs });

84 if (result.timedOut) {

85 throw new Error(`npx skills ${options.operation} timed out after ${timeoutMs}ms`);

86 }

87 if (result.status === null && result.signal) {

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

67import { createHash } from "node:crypto"; L68: import { spawnSync } from "node:child_process"; L69: import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L67

61Cross-file remote execution chain: dist/cli.js spawns assets/portfolio-dashboard/app.js; helper contains network access plus dynamic code execution. L61: const bundlePath = join2(bundlesDir, entry.name); L62: return JSON.parse(readFileSync(bundlePath, "utf8")); L63: }).sort((a, b) => a.id.localeCompare(b.id)); ... L67: import { createHash } from "node:crypto"; L68: import { spawnSync } from "node:child_process"; L69: import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs"; ... L90: if (result.status !== 0) { L91: throw new Error(`npx skills ${options.operation} failed with exit code ${result.status}`); L92: } ... L235: "public", L236: "private", L237: "third-party"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L61

Findings

3 High2 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 41-87javascript

41 return files.sort();

42}

43function toUnixPath(path) {

44 return path.replaceAll("\\", "/");

45}

46function isPlatformMetadata(name) {

47 return name === ".DS_Store" || name === "Thumbs.db" || name.startsWith("._");

48}

50// src/commands/assets.ts

51import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";

52import { dirname as dirname5, join as join11 } from "node:path";

54// src/asset-bundles/bundles.ts

55import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync } from "node:fs";

56import { join as join2 } from "node:path";

57function loadAgentAssetBundles(agentAssetsDir) {

58 const bundlesDir = join2(agentAssetsDir, "bundles");

59 if (!existsSync2(bundlesDir)) return [];

60 return readdirSync2(bundlesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => {

61 const bundlePath = join2(bundlesDir, entry.name);

62 return JSON.parse(readFileSync(bundlePath, "utf8"));

63 }).sort((a, b) => a.id.localeCompare(b.id));

64}

66// src/asset-npx/maintenance.ts

67import { createHash } from "node:crypto";

68import { spawnSync } from "node:child_process";

69import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L61

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L67

70import { join as join3, relative as relative2 } from "node:path";

71import { tmpdir } from "node:os";

72function createNpxSkillsMaintenancePlan(options) {

73 assertNativeNpxRoot(options.npxRoot);

74 if (options.operation === "add" && !options.source) {

75 throw new Error("npx skills add requires a source.");

76 }

77 const before = snapshotFiles(options.npxRoot);

78 const tempRoot = mkdtempSync(join3(tmpdir(), "pro-gov-npx-skills-"));

79 cpSync(options.npxRoot, tempRoot, { recursive: true, dereference: false });

80 const command2 = buildNpxCommand(options);

81 const runner = options.runner ?? defaultRunner;

82 const timeoutMs = options.timeoutMs ?? 3e5;

83 const result = runner({ command: command2, cwd: tempRoot, timeoutMs });

84 if (result.timedOut) {

85 throw new Error(`npx skills ${options.operation} timed out after ${timeoutMs}ms`);

86 }

87 if (result.status === null && result.signal) {