registry / @riftydev/shell / 0.2.0

@riftydev/shell@0.2.0

Tiny bash-flavoured shell for rifty, backed by @riftydev/vfs.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. This is an interactive virtual shell whose file, Git, and optional binary-execution capabilities require explicit runtime commands and host configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer constructs `Shell` and runs a command; `.bin` execution additionally requires a host-provided `execBin`.

Impact

Can alter the configured virtual filesystem or contact a user-specified Git remote, consistent with package purpose.

Mechanism

User-directed virtual shell and Git command dispatch.

Rationale

Static inspection shows a purpose-aligned browser/virtual shell, not unsolicited payload execution. Scanner network and secret signals map to Git-shell functionality and ordinary token parsing rather than exfiltration or embedded secrets.

Evidence

package.jsondist/index.jsdist/index.d.tsREADME.md

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` exposes an injected `execBin` callback for user-invoked `.bin` commands.
`dist/index.js` supports user-requested Git fetch/pull/push, including URL-like remotes.
Built-in shell commands can modify the configured virtual filesystem.

Evidence against

`package.json` has no preinstall, install, postinstall, or other lifecycle hook.
`dist/index.js` imports only `@riftydev` modules; no `child_process`, `eval`, `Function`, dynamic import, or network API is present.
The executor is host-supplied and only reached after an explicit shell command resolves a `.bin` shim.
No credential harvesting, external endpoint, persistence, AI-agent configuration write, or stealth import-time action was found.

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 180 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 3680-3720javascript

3680` : `head: cannot open '${file}' for reading: No such file or directory

3681`;

3682 ctx.stderr.write(msg);

3683 status = 1;

3684 continue;

3685 }

3686 }

3687 if (showHeaders) {

3688 if (printed > 0) ctx.stdout.write("\n");

3689 ctx.stdout.write(`==> ${file === "-" ? "standard input" : file} <==

3690`);

3691 }

3692 ctx.stdout.write(dec.decode(slice(buf, opts)));

3693 printed++;

3694 }

3695 return status;

3696};

3697

3698// src/commands/help.ts

3699var SYNOPSIS = {

3700 pwd: "print the current working directory",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L3700

3701 cd: "change the current working directory",

3702 echo: "write arguments to stdout",

3703 ls: "list directory contents",

3704 cat: "concatenate files (or stdin) to stdout",

3705 mkdir: "create directories",

3706 rm: "remove files and directories",

3707 env: "print environment variables",

3708 find: "walk the file tree",

3709 grep: "search for a pattern in files or stdin",

3710 git: "version control (subset)",

3711 which: "locate a command",

3712 clear: "clear the terminal screen",

3713 touch: "create empty files or bump mtime",

3714 head: "print the leading lines of files or stdin",

3715 jobs: "list background jobs",

3716 tail: "print the trailing lines of files",

3717 wc: "count lines, words and bytes",

3718 basename: "strip directory and suffix from a path",

3719 dirname: "strip the last component from a path",

3720 realpath: "resolve a path to its absolute form",

Source & flagged code

1 flagged · loading source

dist/index.jsView file

3700patternName = generic_password severity = medium line = 3700 matchedText = pwd: "pr...ry",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L3700

Findings

2 Medium3 Low

MediumSecret Patterndist/index.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 3680-3720javascript

3680` : `head: cannot open '${file}' for reading: No such file or directory

3681`;

3682 ctx.stderr.write(msg);

3683 status = 1;

3684 continue;

3685 }

3686 }

3687 if (showHeaders) {

3688 if (printed > 0) ctx.stdout.write("\n");

3689 ctx.stdout.write(`==> ${file === "-" ? "standard input" : file} <==

3690`);

3691 }

3692 ctx.stdout.write(dec.decode(slice(buf, opts)));

3693 printed++;

3694 }

3695 return status;

3696};

3697

3698// src/commands/help.ts

3699var SYNOPSIS = {

3700 pwd: "print the current working directory",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L3700

3701 cd: "change the current working directory",

3702 echo: "write arguments to stdout",

3703 ls: "list directory contents",

3704 cat: "concatenate files (or stdin) to stdout",

3705 mkdir: "create directories",

3706 rm: "remove files and directories",

3707 env: "print environment variables",

3708 find: "walk the file tree",

3709 grep: "search for a pattern in files or stdin",

3710 git: "version control (subset)",

3711 which: "locate a command",

3712 clear: "clear the terminal screen",

3713 touch: "create empty files or bump mtime",

3714 head: "print the leading lines of files or stdin",

3715 jobs: "list background jobs",

3716 tail: "print the trailing lines of files",

3717 wc: "count lines, words and bytes",

3718 basename: "strip directory and suffix from a path",

3719 dirname: "strip the last component from a path",

3720 realpath: "resolve a path to its absolute form",