registry / @reddb-io/red-skills / 2.22.1

@reddb-io/red-skills@2.22.1

RedSkills plugin runtime bundles (dev, memory, brain) distributed over npm — the v2 client transport (ADR 0091). Carries the platform-independent JS bundles inside the tarball plus thin bin shims; no postinstall download.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 820 KB of source, external domains: api.github.com, api.minimax.io, github.com, jimmy.warting.se, json-schema.org, raw.githubusercontent.com

Oversized source lightweight scan

dist/dev.bundle.min.mjs2.03 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsapi.github.comapi.minimax.iogithub.comjimmy.warting.se

dist/memory.bundle.min.mjs4.61 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalObfuscatedHighEntropyStringsMinified

Source & flagged code

7 flagged

bin/red-skills-memory.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-memory — thin shim that execs the `memory` runtime bundle packaged

4 * inside this npm tarball (`dist/memory.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Memory runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * memory bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process";

11import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

12import { dirname, join } from "node:path";

13import { fileURLToPath } from "node:url";

15const here = dirname(fileURLToPath(import.meta.url));

16const bundle = join(here, "..", "dist", "memory.bundle.min.mjs");

17if (!existsSync(bundle)) {

18 process.stderr.write(`red-skills-memory: packaged bundle missing at ${bundle}\n`);

19 process.exit(1);

20}

21const res = spawnSync(process.execPath, [bundle, ...process.argv.slice(2)], { stdio: "inherit" });

22if (res.signal) process.kill(process.pid, res.signal);

23process.exit(res.status ?? 1);

dist/brain.bundle.min.mjsView file

Lines 1-50javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);

3var my=Object.create;var li=Object.defineProperty;var hy=Object.getOwnPropertyDescriptor;var gy=

bin/red-skills-brain.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-brain — thin shim that execs the `brain` runtime bundle packaged

4 * inside this npm tarball (`dist/brain.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Brain runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * brain bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process"

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4836821 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4836821 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg

Source & flagged code

7 flagged · loading source

bin/red-skills-memory.mjsView file

9*/ L10: import { spawnSync } from "node:child_process"; L11: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

dist/brain.bundle.min.mjsView file

6|| (${s} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,A._)`+${o}`);return;case"boolean":n.elseIf((0,A._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L7: || ${s} === "boolean" || ${o} === null`).assign(a,(0,A._)`[${o}]`)}}}function _w({gen:e,parentData:t,parentDataProperty:r},n){e.if((0,A._)`${t} !== undefined`,()=>e.assign((0,A._)`... L8: missingProperty: ${n}, L9: depsCount: ${t}, L10: deps: ${r}}`};var Qx={keyword:"dependencies",type:"object",schemaType:"object",error:Qe.error,code(e){let[t,r]=Yx(e);Em(e,t),zm(e,r)}};function Yx({schema:e}){let t={},r={};for(let... L11: `).filter(s=>s),o=Math.min(...n.map(s=>s.length-s.trimStart().length)),i=n.map(s=>s.slice(o)).map(s=>" ".repeat(this.indent*2)+s);for(let s of i)this.content.push(s)}compile(){let ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/brain.bundle.min.mjsView on unpkg · L6

30} L31: `)}else{let $=g[w];p.write(`const ${$} = ${h(w)};`),p.write(` L32: if (${$}.issues.length) payload.issues = payload.issues.concat(${$}.issues.map(iss => ({ ... L36: `);if(t===-1)return null;let r=this._buffer.toString("utf8",0,t).replace(/\r$/,"");return this._buffer=this._buffer.subarray(t+1),QS(r)}clear(){this._buffer=void 0}};function QS(e)... L37: `}var XS=Nc.platform==="win32"?["APPDATA","HOMEDRIVE","HOMEPATH","LOCALAPPDATA","PATH","PROCESSOR_ARCHITECTURE","SYSTEMDRIVE","SYSTEMROOT","TEMP","USERNAME","USERPROFILE","PROGRAMF... L38: `).trim();if(!i)return{};try{return JSON.parse(i)}catch{return{text:i}}}};function rE(){let e={};for(let[t,r]of Object.entries(process.env))typeof r=="string"&&(e[t]=r);return e}fu... L39: `)){let i=o.replace(/\r$/,"");if(!/".*"/.test(i)&&!/'.*'/.test(i)){let p=i.indexOf("#");p>=0&&(i=i.slice(0,p))}if(i.replace(/\s/g,"")==="")continue;let s=i.match(/^ */)?.[0].length... L40: `,"utf8")),t}async function bE(e){let t=pg(e);try{let r=await Ac(t,"utf8");return wE(r)}catch(r){if(r.code==="ENOENT")return null;throw r}}function wE(e){let t=e.split(/\r?\n/).map... L41: expected at: ${i} ... L44: or check the postinstall log for a download error.`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/brain.bundle.min.mjsView on unpkg · L30

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/brain.bundle.min.mjsView on unpkg · L6

bin/red-skills-brain.mjsView file

9Cross-file remote execution chain: bin/red-sk[redacted] spawns dist/brain.bundle.min.mjs; helper contains network access plus dynamic code execution. L9: */ L10: import { spawnSync } from "node:child_process"; L11: import { existsSync } from "node:fs"; ... L17: if (!existsSync(bundle)) { L18: process.stderr.write(`red-skills-brain: packaged bundle missing at ${bundle}\n`); L19: process.exit(1);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/red-skills-brain.mjsView on unpkg · L9

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4836821 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4836821 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg

Findings

6 High5 Medium5 Low

HighChild Processbin/red-skills-memory.mjs

HighShell

HighSame File Env Network Executiondist/brain.bundle.min.mjs

HighCommand Output Exfiltrationdist/brain.bundle.min.mjs

HighCross File Remote Execution Contextbin/red-skills-brain.mjs

HighOversized Source Filedist/memory.bundle.min.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointdist/memory.bundle.min.mjs

MediumStructural Risk Force Deep Review

LowEvaldist/brain.bundle.min.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/red-skills-memory.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-memory — thin shim that execs the `memory` runtime bundle packaged

4 * inside this npm tarball (`dist/memory.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Memory runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * memory bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process";

11import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

12import { dirname, join } from "node:path";

13import { fileURLToPath } from "node:url";

15const here = dirname(fileURLToPath(import.meta.url));

16const bundle = join(here, "..", "dist", "memory.bundle.min.mjs");

17if (!existsSync(bundle)) {

18 process.stderr.write(`red-skills-memory: packaged bundle missing at ${bundle}\n`);

19 process.exit(1);

20}

21const res = spawnSync(process.execPath, [bundle, ...process.argv.slice(2)], { stdio: "inherit" });

22if (res.signal) process.kill(process.pid, res.signal);

23process.exit(res.status ?? 1);

dist/brain.bundle.min.mjsView file

Lines 1-50javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);

3var my=Object.create;var li=Object.defineProperty;var hy=Object.getOwnPropertyDescriptor;var gy=

bin/red-skills-brain.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-brain — thin shim that execs the `brain` runtime bundle packaged

4 * inside this npm tarball (`dist/brain.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Brain runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * brain bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process"

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4836821 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4836821 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg