registry / @reddb-io/red-skills / 2.3.0

@reddb-io/red-skills@2.3.0

RedSkills plugin runtime bundles (dev, memory, brain) distributed over npm — the v2 client transport (ADR 0091). Carries the platform-independent JS bundles inside the tarball plus thin bin shims; no postinstall download.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 2.52 MB of source, external domains: api.minimax.io, feross.org, github.com, json-schema.org, raw.githubusercontent.com, www.apache.org

Oversized source lightweight scan

dist/memory.bundle.min.mjs4.61 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalObfuscatedHighEntropyStringsMinifiedUrlStringsfeross.orggithub.comwww.apache.org

Source & flagged code

9 flagged

bin/red-skills-memory.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-memory — thin shim that execs the `memory` runtime bundle packaged

4 * inside this npm tarball (`dist/memory.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Memory runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * memory bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process";

11import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

12import { dirname, join } from "node:path";

13import { fileURLToPath } from "node:url";

15const here = dirname(fileURLToPath(import.meta.url));

16const bundle = join(here, "..", "dist", "memory.bundle.min.mjs");

17if (!existsSync(bundle)) {

18 process.stderr.write(`red-skills-memory: packaged bundle missing at ${bundle}\n`);

19 process.exit(1);

20}

21const res = spawnSync(process.execPath, [bundle, ...process.argv.slice(2)], { stdio: "inherit" });

22if (res.signal) process.kill(process.pid, res.signal);

23process.exit(res.status ?? 1);

dist/dev.bundle.min.mjsView file

311`)}catch{}}}return t=>{process.stdout.write(t+` L312: `)}}});var Dd,Zq=h(()=>{"use strict";Dd=class{items=[];totalChars=0;maxChars;separator;constructor(t=65536,r=""){this.maxChars=t,this.separator=r}push(t){let r=t.length>this.maxCha... L313: `),y=new Dd(o,"");zXt({input:m.stdout}).on("line",S=>{A.push(S),g(S)}),m.stderr.on("data",S=>{y.push(S.toString())}),m.on("close",S=>{f({stdout:A.toString(),stderr:y.toString(),exi...

High

Shell

Package source references shell execution.

dist/dev.bundle.min.mjsView on unpkg · L311

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev.bundle.min.mjsView on unpkg · L41

41`);r.splice(1,3),t.stack=r.join(` L42: `)}return t},RJ=e=>se(e,vJ),yEe=e=>se(e,FM),MM=e=>se(e,oI),iht=fu(new Map),xEe=()=>iht,BJ=(e,t)=>fu(new Map([[e.key,t]])),EEe=x(3,(e,t,r)=>{let n=new Map(e.unsafeMap);return n.set(... L43: ${this.stack.split(` ... L45: `)}`:this.toString():"Bun"in globalThis?Ol(Dl(this),{renderErrorCause:!0}):this}}return Object.assign(e.prototype,ZF),e}(),mE=(e,t)=>{class r extends kB{_tag=t}return Object.assign... L46: `);if(o[3]!==void 0)return n=o[3].trim(),n}}}},SE=Zo()("[redacted]",{defaultValue:Ni})});var DAt,un,MCe,VP,QB,PCe,LCe,UCe,$Ce,HCe,BI,WCe,jCe,YP,qCe,yf=h(()=>{... L47: `).length;a=r.stack?`(${o}) ${r.stack.split(` ... L53: `).trim(),o}}return ge(()=>{let r=typeof e.options=="function"?e.options.apply(null,arguments):e.options;return IK(ge(()=>Un(()=>e.body.apply(this,arguments))),r.name,{...r,capture... L54: Status: ${d}`})),FK=()=>Array.from(Gl.roots),ike=Y(FK),ske=e=>e.status,MK=e=>NE(bo(e)),ake=MK(void 0),Qm="effect/FiberCurrent",cke=()=>Yr(globalThis[Qm])});var txt,uke,lke,i1,iEr,r... L55: `),a=e.errorCall.stack.trim().split(`

bin/red-skills-dev.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * red-skills-dev — thin shim that execs the `dev` runtime bundle packaged inside

4 * this npm tarball (`dist/dev.bundle.min.mjs`). ADR 0091: the bundle ships in the

5 * package tarball itself (platform-independent JS, ~2MB), so there is no

6 * postinstall download and no GitHub-release fetch. Every arg is forwarded

7 * verbatim to the bundle, which owns its own command surface.

8 */

9import { spawnSync } from "node:child_process";

10import

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4835100 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4835100 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg

Source & flagged code

9 flagged · loading source

bin/red-skills-memory.mjsView file

9*/ L10: import { spawnSync } from "node:child_process"; L11: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

dist/dev.bundle.min.mjsView file

High

Shell

Package source references shell execution.

dist/dev.bundle.min.mjsView on unpkg · L311

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev.bundle.min.mjsView on unpkg · L41

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev.bundle.min.mjsView on unpkg · L41

19`)}if(Z4(e)){let t=[];return eY(e,0,t),t.join(` L20: `)}return uR(e)}var IF,Ex=h(()=>{"use strict";IF=" "});function OAe(e){if(e===void 0||e.trim()==="")return;let t=Number(e);return Number.isFinite(t)&&t>0?t:void 0}function xdt(e,t... L21: `);return EC({status:"discarded",worker:e,duration:`runner-broken, slot parked after ${n} fast deaths`,diff:"discarded",attempt:1,sections:[{name:"summary",body:i}]})}function wdt(... L22: `)){i=i.replace(/\r$/,"");let s=i;if(!/".*"/.test(s)&&!/'.*'/.test(s)){let m=s.indexOf("#");m>=0&&(s=s.slice(0,m))}if(s.replace(/\s/g,"")==="")continue;let c=(s.match(/^\s*/)?.[0]?... ... L45: `)}`:this.toString():"Bun"in globalThis?Ol(Dl(this),{renderErrorCause:!0}):this}}return Object.assign(e.prototype,ZF),e}(),mE=(e,t)=>{class r extends kB{_tag=t}return Object.assign... L46: `);if(o[3]!==void 0)return n=o[3].trim(),n}}}},SE=Zo()("[redacted]",{defaultValue:Ni})});var DAt,un,MCe,VP,QB,PCe,LCe,UCe,$Ce,HCe,BI,WCe,jCe,YP,qCe,yf=h(()=>{... L47: `).length;a=r.stack?`(${o}) ${r.stack.split(` ... L53: `).trim(),o}}return ge(()=>{let r=typeof e.options=="function"?e.options.apply(null,arguments):e.options;return IK(ge(()=>Un(()=>e.body.ap

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/dev.bundle.min.mjsView on unpkg · L19

50${n.join(` L51: `)}`),super(s),this._tag=t,this.traces=n,this[wIe]=WAt,this.name=i,this.stack=a}pipe(){return X(this,arguments)}toString(){return this.stack}[Ce](){return this.stack}},L3=class ext... L52: `).slice(2).join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dev.bundle.min.mjsView on unpkg · L50

bin/red-skills-dev.mjsView file

8Cross-file remote execution chain: bin/red-sk[redacted] spawns dist/dev.bundle.min.mjs; helper contains network access plus dynamic code execution. L8: */ L9: import { spawnSync } from "node:child_process"; L10: import { existsSync } from "node:fs"; ... L16: if (!existsSync(bundle)) { L17: process.stderr.write(`red-skills-dev: packaged bundle missing at ${bundle}\n`); L18: process.exit(1);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/red-skills-dev.mjsView on unpkg · L8

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4835100 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4835100 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg

Findings

7 High4 Medium5 Low

HighChild Processbin/red-skills-memory.mjs

HighShelldist/dev.bundle.min.mjs

HighSame File Env Network Executiondist/dev.bundle.min.mjs

HighCommand Output Exfiltrationdist/dev.bundle.min.mjs

HighObfuscated Payload Loaderdist/dev.bundle.min.mjs

HighCross File Remote Execution Contextbin/red-skills-dev.mjs

HighOversized Source Filedist/memory.bundle.min.mjs

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointdist/memory.bundle.min.mjs

MediumStructural Risk Force Deep Review

LowEvaldist/dev.bundle.min.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

bin/red-skills-memory.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * red-skills-memory — thin shim that execs the `memory` runtime bundle packaged

4 * inside this npm tarball (`dist/memory.bundle.min.mjs`). ADR 0091: the JS bundle

5 * ships in the tarball; no postinstall download. (The Memory runtime's native

6 * `red` engine binary is resolved separately by the plugin at runtime — see the

7 * memory bootstrap — because per-platform native binaries cannot live in a

8 * platform-independent tarball.)

9 */

10import { spawnSync } from "node:child_process";

11import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/red-skills-memory.mjsView on unpkg · L9

12import { dirname, join } from "node:path";

13import { fileURLToPath } from "node:url";

15const here = dirname(fileURLToPath(import.meta.url));

16const bundle = join(here, "..", "dist", "memory.bundle.min.mjs");

17if (!existsSync(bundle)) {

18 process.stderr.write(`red-skills-memory: packaged bundle missing at ${bundle}\n`);

19 process.exit(1);

20}

21const res = spawnSync(process.execPath, [bundle, ...process.argv.slice(2)], { stdio: "inherit" });

22if (res.signal) process.kill(process.pid, res.signal);

23process.exit(res.status ?? 1);

dist/dev.bundle.min.mjsView file

High

Shell

Package source references shell execution.

dist/dev.bundle.min.mjsView on unpkg · L311

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev.bundle.min.mjsView on unpkg · L41

bin/red-skills-dev.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * red-skills-dev — thin shim that execs the `dev` runtime bundle packaged inside

4 * this npm tarball (`dist/dev.bundle.min.mjs`). ADR 0091: the bundle ships in the

5 * package tarball itself (platform-independent JS, ~2MB), so there is no

6 * postinstall download and no GitHub-release fetch. Every arg is forwarded

7 * verbatim to the bundle, which owns its own command surface.

8 */

9import { spawnSync } from "node:child_process";

10import

dist/memory.bundle.min.mjsView file

•path = dist/memory.bundle.min.mjs kind = oversized_source_file sizeBytes = 4835100 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/memory.bundle.min.mjsView on unpkg

•path = dist/memory.bundle.min.mjs kind = oversized_cli_entrypoint sizeBytes = 4835100 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/memory.bundle.min.mjsView on unpkg