Loading npm security reports…

@rigxyz/cli: Suspicious npm security report (Warn) | LPM Firewall

registry / @rigxyz/cli / 0.8.0

@rigxyz/cli@0.8.0

Portable, runnable agent workspaces

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 267 KB of source, external domains: 127.0.0.1, api.github.com, docs.astral.sh, hub.userig.workers.dev, tap-relay.fly.dev, userig.xyz

Source & flagged code

6 flagged

package.jsonView file

Lines 1-25json

2 "name": "@rigxyz/cli",

3 "version": "0.8.0",

4 "description": "Portable, runnable agent workspaces",

5 "type": "module",

6 "bin": {

7 "rig": "bin/rig.mjs"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "README.md"

13 ],

14 "scripts": {

15 "test": "node --test test/",

16 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20"

20 },

21 "dependencies": {

22 "@clack/prompts": "^1.3.0"

23 }

24}

src/collab.mjsView file

Lines 1-32javascript

1// rig <-> tap integration.

2//

3// Rig shells out to the `tapd` CLI and parses its versioned --json contract

4// (protocolVersion: 1). It never imports tapd as a library or touches the

5// state DB directly. See ~/code/tap/rig-tap-integration-plan.md.

6//

7// Auth: rig owns identity. `rig login` writes a Clerk JWT to

8// ~/.config/rig/config.json as `hub_token`. We pass that JWT through

9// to tapd via RIG_HUB_TOKEN env on the two commands that need user

10// identity (init, join). Other tapd commands use the per-binding

src/cli.mjsView file

Lines 2176-2216javascript

2176 }

2177}

2178

2179async function runInstallCommands(config, cwd, { interactive, yes, runHooks }) {

2180 const statuses

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/collab.mjsView file

12import * as p from "@clack/prompts"; L13: import { spawn, spawnSync } from "node:child_process"; L14: import { closeSync, existsSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/collab.mjsView on unpkg · L12

Findings

4 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/collab.mjs

HighShellsrc/cli.mjs

HighSame File Env Network Executionsrc/collab.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/collab.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License