registry / @pzy560117/opensuper / 0.3.8

@pzy560117/opensuper@0.3.8

OpenSpec + Superpowers dual-star development workflow

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 143 KB of source, external domains: registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 24-64json

24 "assets",

25 "scripts/postinstall.js",

26 "!dist/**/*.test.js",

27 "!dist/**/__tests__"

28 ],

29 "scripts": {

30 "build": "node build.js",

31 "dev": "tsc --watch",

32 "test": "vitest run",

33 "test:coverage": "vitest run --coverage",

34 "test:watch": "vitest",

35 "lint": "eslint src/",

36 "lint:fix": "eslint src/ --fix",

37 "format": "prettier --write src/",

38 "format:check": "prettier --check src/",

39 "test:shell": "node scripts/run-bats.js test/shell/*.bats",

40 "benchmark:context": "node scripts/context-compression-benchmark.mjs",

41 "benchmark:execution": "node scripts/context-execution-benchmark.mjs",

42 "prepare": "husky && pnpm run build",

43 "prepublishOnly": "node scripts/prepublish-check.js && pnpm run build",

44 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "lint-staged": {

47 "src/**/*.{ts,tsx,js,mjs,cjs,json,md,yaml,yml}": "prettier --write"

48 },

49 "packageManager": "pnpm@10.18.3",

50 "engines": {

51 "node": ">=20"

52 },

53 "devDependencies": {

54 "@eslint/js": "^10.0.1",

55 "@types/node": "^24.2.0",

56 "@vitest/coverage-v8": "^4.1.6",

57 "eslint": "^10.4.0",

58 "husky": "^9.1.7",

59 "lint-staged": "^17.0.7",

60 "prettier": "^3.8.3",

61 "typescript": "^5.9.3",

62 "typescript-eslint": "^8.59.3",

63 "vitest": "^4.1.6"

64 },

dist/core/openspec.jsView file

Lines 1-21javascript

1import { execFileSync } from 'child_process';

2import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

3import os from 'os';

4import path from 'path';

5import

dist/commands/update.jsView file

Lines 99-139javascript

99}

100function formatNpmUpdateCommand(scope) {

101 return ['npm', ...buildNpmUpdateArgs(scope)].join(' ');

102}

103function formatSkillUpdateCommand(scope, platform, languageSkillsDir) {

dist/core/codegraph.jsView file

Lines 6-46javascript

6 return true;

7 }

8 console.log(' Installing CodeGraph CLI...');

9 try {

10 execFileSync(getNpmExecutable(), ['install', '-g', '@colbymchenry/codegraph'], {

11 cwd: projectPath,

12 stdio:

assets/skills/opensuper/scripts/opensuper-archive.shView file

•path = [redacted]-archive.sh kind = build_helper sizeBytes = 7595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/skills/opensuper/scripts/opensuper-archive.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/openspec.jsView file

1import { execFileSync } from 'child_process'; L2: import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

dist/commands/update.jsView file

119stdio: jsonMode ? 'ignore' : 'inherit', L120: shell: true, L121: });

High

Shell

Package source references shell execution.

dist/commands/update.jsView on unpkg · L119

dist/core/codegraph.jsView file

26if (!cliReady) { L27: console.error(' CodeGraph CLI not available. Install manually: npm install -g @colbymchenry/codegraph'); L28: return 'failed'; ... L31: console.log(' Running: codegraph install --yes'); L32: execFileSync('codegraph', ['install', '--yes'], { L33: cwd: projectPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/codegraph.jsView on unpkg · L26

assets/skills/opensuper/scripts/opensuper-archive.shView file

•path = [redacted]-archive.sh kind = build_helper sizeBytes = 7595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/skills/opensuper/scripts/opensuper-archive.shView on unpkg

Findings

4 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/core/openspec.js

HighShelldist/commands/update.js

HighRuntime Package Installdist/core/codegraph.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/skills/opensuper/scripts/opensuper-archive.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 24-64json

24 "assets",

25 "scripts/postinstall.js",

26 "!dist/**/*.test.js",

27 "!dist/**/__tests__"

28 ],

29 "scripts": {

30 "build": "node build.js",

31 "dev": "tsc --watch",

32 "test": "vitest run",

33 "test:coverage": "vitest run --coverage",

34 "test:watch": "vitest",

35 "lint": "eslint src/",

36 "lint:fix": "eslint src/ --fix",

37 "format": "prettier --write src/",

38 "format:check": "prettier --check src/",

39 "test:shell": "node scripts/run-bats.js test/shell/*.bats",

40 "benchmark:context": "node scripts/context-compression-benchmark.mjs",

41 "benchmark:execution": "node scripts/context-execution-benchmark.mjs",

42 "prepare": "husky && pnpm run build",

43 "prepublishOnly": "node scripts/prepublish-check.js && pnpm run build",

44 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "lint-staged": {

47 "src/**/*.{ts,tsx,js,mjs,cjs,json,md,yaml,yml}": "prettier --write"

48 },

49 "packageManager": "pnpm@10.18.3",

50 "engines": {

51 "node": ">=20"

52 },

53 "devDependencies": {

54 "@eslint/js": "^10.0.1",

55 "@types/node": "^24.2.0",

56 "@vitest/coverage-v8": "^4.1.6",

57 "eslint": "^10.4.0",

58 "husky": "^9.1.7",

59 "lint-staged": "^17.0.7",

60 "prettier": "^3.8.3",

61 "typescript": "^5.9.3",

62 "typescript-eslint": "^8.59.3",

63 "vitest": "^4.1.6"

64 },

dist/core/openspec.jsView file

Lines 1-21javascript

1import { execFileSync } from 'child_process';

2import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

3import os from 'os';

4import path from 'path';

5import

dist/commands/update.jsView file

Lines 99-139javascript

99}

100function formatNpmUpdateCommand(scope) {

101 return ['npm', ...buildNpmUpdateArgs(scope)].join(' ');

102}

103function formatSkillUpdateCommand(scope, platform, languageSkillsDir) {

dist/core/codegraph.jsView file

Lines 6-46javascript

6 return true;

7 }

8 console.log(' Installing CodeGraph CLI...');

9 try {

10 execFileSync(getNpmExecutable(), ['install', '-g', '@colbymchenry/codegraph'], {

11 cwd: projectPath,

12 stdio:

assets/skills/opensuper/scripts/opensuper-archive.shView file

•path = [redacted]-archive.sh kind = build_helper sizeBytes = 7595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/skills/opensuper/scripts/opensuper-archive.shView on unpkg