registry / @reinit-ai/cli / 0.1.9

@reinit-ai/cli@0.1.9

REINIT — pull jobs + profile, evaluate locally, push reports back. (Indian market)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 300 KB of source, external domains: api.beta.reinit.in, api.github.com, api.lever.co, boards-api.greenhouse.io, discord.gg, github.com, linkedin.com, nodejs.org, pdf.reinit.in, raw.githubusercontent.com

Source & flagged code

4 flagged

config/profile.example.ymlView file

Lines 33-73yaml

33 # Your professional headline (1 line)

34 headline: "ML Engineer turned AI product builder"

35 # Your exit story — what makes you unique

36 exit_story: "Built and sold my SaaS after 5 years. Now focused on applied AI at scale."

37 # Your top 3-5 superpowers

38 superpowers:

39 - "End-to-end ML pipelines"

40 - "Fast prototyping (idea to prod in 2 weeks)"

41 - "Cross-functional communication"

42 # Proof points — projects, articles, case studies with measurable impact

43 proof_points:

44 - name: "Project Alpha"

45 url: "https://janesmith.dev/project-alpha"

46 hero_metric: "Reduced inference latency 40%"

47 - name: "Open Source Tool"

48 url: "https://github.com/janesmith/tool"

49 hero_metric: "2K+ GitHub stars"

50 # Optional: dashboard/demo URL with credentials

51 # dashboard:

52 # url: "https://janesmith.dev/demo"

53 # password: "demo-2026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

55compensation:

56 target_range: "$150K-200K" # Your target total comp

57 currency: "USD"

58 minimum: "$120K" # Walk-away number

59 location_flexibility: "Remote preferred, 1 week/month on-site possible"

61location:

62 country: "United States"

63 city: "San Francisco"

64 timezone: "PST"

65 visa_status: "No sponsorship needed"

66 # For remote roles outside your country:

67 # onsite_availability: "1 week/month in any city"

69# Optional follow-up cadence preferences for `node src/tracker/followup-cadence.mjs`.

70# CLI flags still win for one-off runs (for example `--applied-days 10`).

71# followup_cadence:

72# applied_first_days: 7

73# applied_subsequent_days: 7

src/tracker/merge-tracker.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { PACKAGE_ROOT } from "../lib/package-root.mjs";

3/**

4 * merge-tracker.mjs — Merge batch tracker additions into applications.md

5 *

6 * Handles multiple TSV formats:

7 * - 9-col: num\tdate\tcompany\trole\tstatus\tscore\tpdf\treport\tnotes

8 * - 8-col: num\tdate\tcompany\trole\tstatus\tscore\tpdf\treport (no notes)

9 * - Pipe-delimited (markdown table row): | col | col | ... |

10 *

src/system/update-system.mjsView file

Lines 650-690javascript

650 try {

651 revertPaths([...updated]);

652 } catch (revertErr) {

653 // If the revert itself fails, don't lose the safety-violation

654 // diagnostic — chain it via `cause` so the user sees both.

655 throw new Error(

656 `Safety violation (${violation

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

Source & flagged code

4 flagged · loading source

config/profile.example.ymlView file

53patternName = generic_password severity = medium line = 53 matchedText = # pass...026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

src/tracker/merge-tracker.mjsView file

20import { fileURLToPath } from 'url'; L21: import { execFileSync } from 'child_process'; L22: import { createHash, randomUUID } from 'crypto';

High

Child Process

Package source references child process execution.

src/tracker/merge-tracker.mjsView on unpkg · L20

src/system/update-system.mjsView file

670try { L671: execSync('npm install --silent', { cwd: ROOT, timeout: 60000 }); L672: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/system/update-system.mjsView on unpkg · L670

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

Findings

4 High4 Medium5 Low

HighChild Processsrc/tracker/merge-tracker.mjs

HighShell

HighRuntime Package Installsrc/system/update-system.mjs

HighShips High Entropy Blobfonts/space-grotesk-latin.woff2

MediumSecret Patternconfig/profile.example.yml

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

config/profile.example.ymlView file

Lines 33-73yaml

33 # Your professional headline (1 line)

34 headline: "ML Engineer turned AI product builder"

35 # Your exit story — what makes you unique

36 exit_story: "Built and sold my SaaS after 5 years. Now focused on applied AI at scale."

37 # Your top 3-5 superpowers

38 superpowers:

39 - "End-to-end ML pipelines"

40 - "Fast prototyping (idea to prod in 2 weeks)"

41 - "Cross-functional communication"

42 # Proof points — projects, articles, case studies with measurable impact

43 proof_points:

44 - name: "Project Alpha"

45 url: "https://janesmith.dev/project-alpha"

46 hero_metric: "Reduced inference latency 40%"

47 - name: "Open Source Tool"

48 url: "https://github.com/janesmith/tool"

49 hero_metric: "2K+ GitHub stars"

50 # Optional: dashboard/demo URL with credentials

51 # dashboard:

52 # url: "https://janesmith.dev/demo"

53 # password: "demo-2026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

55compensation:

56 target_range: "$150K-200K" # Your target total comp

57 currency: "USD"

58 minimum: "$120K" # Walk-away number

59 location_flexibility: "Remote preferred, 1 week/month on-site possible"

61location:

62 country: "United States"

63 city: "San Francisco"

64 timezone: "PST"

65 visa_status: "No sponsorship needed"

66 # For remote roles outside your country:

67 # onsite_availability: "1 week/month in any city"

69# Optional follow-up cadence preferences for `node src/tracker/followup-cadence.mjs`.

70# CLI flags still win for one-off runs (for example `--applied-days 10`).

71# followup_cadence:

72# applied_first_days: 7

73# applied_subsequent_days: 7

src/tracker/merge-tracker.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { PACKAGE_ROOT } from "../lib/package-root.mjs";

3/**

4 * merge-tracker.mjs — Merge batch tracker additions into applications.md

5 *

6 * Handles multiple TSV formats:

7 * - 9-col: num\tdate\tcompany\trole\tstatus\tscore\tpdf\treport\tnotes

8 * - 8-col: num\tdate\tcompany\trole\tstatus\tscore\tpdf\treport (no notes)

9 * - Pipe-delimited (markdown table row): | col | col | ... |

10 *

src/system/update-system.mjsView file

Lines 650-690javascript

650 try {

651 revertPaths([...updated]);

652 } catch (revertErr) {

653 // If the revert itself fails, don't lose the safety-violation

654 // diagnostic — chain it via `cause` so the user sees both.

655 throw new Error(

656 `Safety violation (${violation

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg