registry / @qingflow-tech/qingflow-cli / 1.1.39

@qingflow-tech/qingflow-cli@1.1.39

Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 24.6 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

2 "name": "@qingflow-tech/qingflow-cli",

3 "version": "1.1.39",

4 "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "qingflow": "./npm/bin/qingflow.mjs",

9 "qingflow-skills": "./npm/bin/qingflow-skills.mjs"

10 },

11 "scripts": {

12 "postinstall": "node ./npm/scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "files": [

15 "README.md",

16 "pyproject.toml",

17 "entry_point.py",

18 "src/qingflow_mcp/**/*.py",

19 "src/qingflow_mcp/py.typed",

20 "qingflow",

21 "npm/",

22 "docs/local-agent-install.md",

23 "skills/"

24 ],

25 "engines": {

26 "node": ">=16.16.0"

27 },

28 "keywords": [

29 "mcp",

30 "qingflow",

31 "agent",

32 "stdio",

npm/bin/qingflow.mjsView file

Lines 15-44javascript

15 // bin files live in <pkg>/npm/bin/, runtime.mjs lives in the sibling <pkg>/npm/lib/,

16 // so step up one level before joining the requested segments.

17 const direct = path.join(scriptDir, "..", ...segments);

18 if (fs.existsSync(direct)) {

19 return pathToFileURL(direct).href;

20 }

21 if (path.basename(scriptDir) === ".bin") {

22 const binName = path.basename(scriptPath);

23 const pkgName = PKG_BY_BIN[binName];

24 if (!pkgName) {

25 throw new Error(`Unknown qingflow command: ${binName}`);

26 }

27 const scope = process.env.QINGFLOW_NPM_SCOPE || "@qingflow-tech";

28 const fromBin = path.join(scriptDir, "..", scope, pkgName, "npm", ...segments);

29 if (fs.existsSync(fromBin)) {

30 return pathToFileURL(fromBin).href;

31 }

32 }

33 throw new Error(`Cannot locate ${segments.join("/")} from ${scriptPath}`);

34}

36const { getPackageRoot, spawnServer, runSkillsCli } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs"));

37const packageRoot = getPackageRoot(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

npm/bin/qingflow.mjsView on unpkg · L35

38const args = process.argv.slice(2);

39if (args[0] === "skills") {

40 runSkillsCli(packageRoot, args.slice(1));

41} else {

42 spawnServer(packageRoot, args, "qingflow", { allowRuntimeBootstrap: true, stdio: "inherit" });

43}

entry_point.pyView file

•path = entry_point.py kind = build_helper sizeBytes = 376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

entry_point.pyView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./npm/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./npm/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/bin/qingflow.mjsView file

35L36: const { getPackageRoot, spawnServer, runSkillsCli } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs")); L37: const packageRoot = getPackageRoot(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

npm/bin/qingflow.mjsView on unpkg · L35

entry_point.pyView file

•path = entry_point.py kind = build_helper sizeBytes = 376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

entry_point.pyView on unpkg

Findings

1 High5 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirenpm/bin/qingflow.mjs

MediumEnvironment Vars

MediumShips Build Helperentry_point.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

2 "name": "@qingflow-tech/qingflow-cli",

3 "version": "1.1.39",

4 "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "qingflow": "./npm/bin/qingflow.mjs",

9 "qingflow-skills": "./npm/bin/qingflow-skills.mjs"

10 },

11 "scripts": {

12 "postinstall": "node ./npm/scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "files": [

15 "README.md",

16 "pyproject.toml",

17 "entry_point.py",

18 "src/qingflow_mcp/**/*.py",

19 "src/qingflow_mcp/py.typed",

20 "qingflow",

21 "npm/",

22 "docs/local-agent-install.md",

23 "skills/"

24 ],

25 "engines": {

26 "node": ">=16.16.0"

27 },

28 "keywords": [

29 "mcp",

30 "qingflow",

31 "agent",

32 "stdio",

npm/bin/qingflow.mjsView file

Lines 15-44javascript

15 // bin files live in <pkg>/npm/bin/, runtime.mjs lives in the sibling <pkg>/npm/lib/,

16 // so step up one level before joining the requested segments.

17 const direct = path.join(scriptDir, "..", ...segments);

18 if (fs.existsSync(direct)) {

19 return pathToFileURL(direct).href;

20 }

21 if (path.basename(scriptDir) === ".bin") {

22 const binName = path.basename(scriptPath);

23 const pkgName = PKG_BY_BIN[binName];

24 if (!pkgName) {

25 throw new Error(`Unknown qingflow command: ${binName}`);

26 }

27 const scope = process.env.QINGFLOW_NPM_SCOPE || "@qingflow-tech";

28 const fromBin = path.join(scriptDir, "..", scope, pkgName, "npm", ...segments);

29 if (fs.existsSync(fromBin)) {

30 return pathToFileURL(fromBin).href;

31 }

32 }

33 throw new Error(`Cannot locate ${segments.join("/")} from ${scriptPath}`);

34}

36const { getPackageRoot, spawnServer, runSkillsCli } = await import(resolvePackageModule(import.meta.url, "lib", "runtime.mjs"));

37const packageRoot = getPackageRoot(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

npm/bin/qingflow.mjsView on unpkg · L35

38const args = process.argv.slice(2);

39if (args[0] === "skills") {

40 runSkillsCli(packageRoot, args.slice(1));

41} else {

42 spawnServer(packageRoot, args, "qingflow", { allowRuntimeBootstrap: true, stdio: "inherit" });

43}

entry_point.pyView file

•path = entry_point.py kind = build_helper sizeBytes = 376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

entry_point.pyView on unpkg