registry  /  @qearlyao/familiar  /  0.7.0

@qearlyao/familiar@0.7.0

Familiar is a single-owner companion agent daemon for Discord and a local WebUI. It keeps durable chat logs, model/provider settings, media attachments, TTS, web search/fetch tools, memory/LCM recall, scheduled heartbeat/cron prompts, and optional real-br

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 146 file(s), 1.39 MB of source, external domains: api.anthropic.com, api.browser-use.com, api.elevenlabs.io, api.exa.ai, api.fetch.tinyfish.ai, api.groq.com, api.openai.com, api.search.brave.com, api.tavily.com, api.x.ai, discord.com, example.com, files.catbox.moe, generativelanguage.googleapis.com, github.com, openrouter.ai, r.jina.ai, radix-ui.com, react.dev, www.apple.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/web/events.jsView file
2export function encodeFrame(text) { L3: const payload = Buffer.from(text, "utf8"); L4: let header; ... L43: if (bigLength > BigInt(Number.MAX_SAFE_INTEGER)) L44: throw new Error("WebSocket frame too large"); L45: length = Number(bigLength); ... L69: if (typeof key !== "string") { L70: socket.write("HTTP/1.1 400 Bad Request\r\n\r\n"); L71: socket.destroy();
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/web/events.jsView on unpkg · L2
dist/web-tools/safety.jsView file
1import net from "node:net"; L2: import { ProviderError } from "./types.js";
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web-tools/safety.jsView on unpkg · L1
scripts/install.shView file
•path = scripts/install.sh kind = build_helper sizeBytes = 5962 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg
dist/web/static.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @qearlyao/familiar@0.6.1 matchedIdentity = npm:QHFlYXJseWFvL2ZhbWlsaWFy:0.6.1 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/static.jsView on unpkg

Findings

2 High4 Medium5 Low
HighCloud Metadata Accessdist/web-tools/safety.js
HighPrevious Version Dangerous Deltadist/web/static.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/web/events.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings