registry / @qwen-code/audio-capture / 0.19.12

@qwen-code/audio-capture@0.19.12

Native microphone capture backend for Qwen Code voice input

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNativeBindingsShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 3 file(s), 3.51 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "exports": {

9 ".": {

10 "types": "./dist/index.d.ts",

11 "import": "./dist/index.js"

12 }

13 },

14 "files": [

15 "dist",

16 "!dist/**/*.test.*",

17 "prebuilds",

18 "native/audio_capture.cc",

19 "native/mac_permission.mm",

20 "native/miniaudio.h",

21 "binding.gyp",

22 "install.js"

23 ],

24 "scripts": {

25 "install": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "prebuildify": "prebuildify --napi --strip",

27 "build": "node-gyp rebuild && tsc --build",

28 "build:ts": "tsc --build",

29 "test": "vitest run",

30 "test:ci": "vitest run",

31 "typecheck": "tsc --noEmit"

32 },

33 "dependencies": {

34 "node-gyp-build": "^4.8.4"

35 },

36 "devDependencies": {

37 "node-gyp": "^11.2.0",

38 "prebuildify": "^6.0.1",

39 "typescript": "^5.3.3",

40 "vitest": "^3.1.1"

41 },

42 "engines": {

43 "node": ">=22"

44 }

45}

prebuilds/linux-arm64/@qwen-code+audio-capture.nodeView file

•path = prebuilds/linux-arm64/@qwen-code+audio-capture.node kind = native_binary sizeBytes = 796984 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/linux-arm64/@qwen-code+audio-capture.nodeView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code