registry / @retineo/core / 0.6.1

@retineo/core@0.6.1

Connection discovery engine (L0–L3). Open-source core for the Retineo ecosystem.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 454 KB of source, external domains: api.openai.com, github.com, huggingface.co, ollama.com

Source & flagged code

3 flagged

dist/adapters/video/adapter.cjsView file

Lines 1-27javascript

1/**

2 * ECHO Real Video Adapter

3 * Extracts audio via ffmpeg → transcribe with whisper.cpp (primary) → OpenAI Whisper API (fallback) → graceful empty.

4 * Extracts key frames via ffmpeg (placeholder descriptions).

5 * Supports: .mp4 .avi .mov .mkv .webm

6 */

8const readline = require('readline');

9const fs = require('fs').promises;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/video/adapter.cjsView on unpkg · L7

10const path = require('path');

11const os = require('os');

12const { spawn } = require('child_process');

14const rl = readline.createInterface({ input: process.stdin });

16const SUPPORTED_MIMES = [

17 'video/mp4',

18 'video/x-msvideo',

19 'video/quicktime',

20 'video/x-matroska',

21 'video/webm',

22];

24const SUPPORTED_EXTS = ['.mp4', '.avi', '.mov', '.mkv', '.webm'];

26const SEGMENT_MS = 300000; // 5 minutes

27const DEFAULT_WHISPER_URL = 'https://api.openai.com/v1/audio/transcriptions';

dist/embeddings/hnsw-index.jsView file

Lines 43-83javascript

43 }));

44 scored.sort((a, b) => a.distance - b.distance);

45 return scored.slice(0, k);

46 }

47 async save

dist/cli/commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @retineo/core@0.5.1 matchedIdentity = npm:QHJldGluZW8vY29yZQ:0.5.1 similarity = 0.647 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/adapters/video/adapter.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code