registry / @rizom/brain / 0.2.0-alpha.137

@rizom/brain@0.2.0-alpha.137

Brain runtime + CLI — scaffold, run, and manage AI brain instances

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 12 file(s), 3.71 MB of source, external domains: api.cloudflare.com, api.hetzner.cloud, cdn.jsdelivr.net, example.com, fonts.googleapis.com, github.com, react.dev, reactjs.org, rizom.ai, tailwindcss.com, www.w3.org, www.w3ctech.com

Oversized source lightweight scan

dist/brain.js6.87 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalNativeBindingsHighEntropyStringsUrlStringsapi.cloudflare.comapi.hetzner.cloudgithub.comrizom.ai

dist/ui/app.js13.7 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsgithub.comreact.devreactjs.orgwww.w3.org

Source & flagged code

6 flagged

dist/services.jsView file

Lines 22-62javascript

22`,V?1+H:H);else if(U)U=!1,$.result+=K0.repeat(`

23`,H+1);else if(H===0){if(V)$.result+=" "}else $.result+=K0.repeat(`

24`,H);else $.result+=K0.repeat(`

25`,V?1+H:H);V=!0,Y=!0,H=0,J=$.position;while(!q0(D)&&D!==0)D=$.input.charCodeAt(++$.position);N0($,J,$.position,!1)}return!0}function i7($,G){var J,X=$.tag,q=$.anchor,V=[],Y,W=!1,H;if($.anchor!==null)$.anchorMap[$.anchor]=V;H=$.input.charCodeAt($.position);while(H!==0){if(H!==45)break;if(Y=$.input.charCodeAt($.position+1),!k1(Y))break;if(W=!0,$.position++,Q1($,!0,-1)){if($.lineIndent<=G){V.push(null),H=$.input.charCodeAt($.position);continue}}if(J=$.line,B2($,G,s7,!1,!0),V.push($.result),Q1($,!0,-1),H=$.input.charCodeAt($.position),($.line===J||$.lineIndent>G)&&H!==0)m($,"bad indentation of a s ...

26`;if($.charCodeAt(0)===65279)$=$.slice(1)}var J=new IY($,G),X=$.indexOf("\x00");if(X!==-1)J.position=X,m(J,"null byte is not allowed in input");J.input+="\x00";while(J.input.charCodeAt(J.position)===32)J.lineIndent+=1,J.position+=1;while(J.position<J.length-1)yY(J);return J.documents}function Y$($,G,J){if(G!==null&&typeof G==="object"&&typeof J>"u")J=G,G=null;var X=q$($,J);if(typeof G!=="function")return X;for(var q=0,V=X.length;q<V;q+=1)G(X[q])}function V$($,G){var J=q$($,G);if(J.length===0)return;else if(J.length===1)return J[0];throw new o7("expected a single document in the stream, but fou ...

27`,X),q===-1)Y=$.slice(X),X=W;else Y=$.slice(X,q+1),X=q+1;if(Y.length&&Y!==`

28`)V+=J;V+=Y}return V}function M6($,G){return`

29`+H4.repeat(" ",$.indent*G)}function zV($,G){var J,X,q;for(J=0,X=$.implicitTypes.length;J<X;J+=1)if(q=$.implicitTypes[J],q.resolve(G))return!0;return!1}function D6($){return $===aY||$===oY}function O2($){return 32<=$&&$<=126||161<=$&&$<=55295&&$!==8232&&$!==8233||57344<=$&&$<=65533&&$!==65279||65536<=$&&$<=1114111}function KV($){return O2($)&&!D6($)&&$!==65279&&$!==nY&&$!==W4}function M$($,G){return O2($)&&$!==65279&&$!==O$&&$!==w$&&$!==j$&&$!==N$&&$!==Z$&&$!==A$&&($!==B$||G&&KV(G))}function FV($){return O2($)&&$!==65279&&!D6($)&&$!==XV&&$!==VV&&$!==A$&&$!==O$&&$!==w$&&$!==j$&&$!==N$&&$!==Z$&& ...

30`,q=X&&($[$.length-2]===`

31`||$===`

32`),V=q?"+":X?"":"-";return J+V+`

33`}function D$($){return $[$.length-1]===`

34`?$.slice(0,-1):$}function OV($,G){var J=/(\n+)([^\n]*)/g,X=function(){var U=$.indexOf(`

35`);return U=U!==-1?U:$.length,J.lastIndex=U,z$($.slice(0,U),G)}(),q=$[0]===`

36`||$[0]===" ",V,Y;while(Y=J.exec($)){var W=Y[1],H=Y[2];V=H[0]===" ",X+=W+(!q&&!V

37`:"")+z$(H,G),q=V}return X}function z$($,G){if($===""||$[0]===" ")return $;var J=/ [^ ]/g,X,q

38`+$.slice(q,V),q=V+1;Y=W}if(H+=`

39`,$.length-q>G&&Y>q)H+=$.slice(q,Y)+`

40`+$.slice(Y+1);else H+=$.slice(q);return H.slice(1)}function AV($){var G="",J,X,q;for(var V=0;V<$.length

41`;return""}function PV($,G){return E$($,H4.extend({schema:iY},G))}LV.dump=E$;LV.safeDump=PV});var b$=f((EV,W1)=>{var t4=W$(),S$=C$();function e4($){return function(){throw Error("Function "+$+" is deprecated and cannot be used.")}}EV.Type=F1();EV.Schema=l0();EV.FAILSAFE_SCHEMA=d4();EV.JSON_SCHEMA=J6();EV.CORE_SCHEMA=X6();EV.DEFAULT_SAFE_SCHEMA=K2();EV.DEFAULT_FULL_SCHEMA=Y4();EV.load=t4.load;EV.loadAll=t4.loadAll;EV.safeLoad=t4.safeLoad;EV.safeLoadAll=t4.safeLoadAll;EV.dump=S$.dump;EV.safeDump=S$.safeDump;EV.YAMLException=D2();EV.MINIMAL_SCHEMA=d4();EV.SAFE_SCHEMA=K2();EV.DEFAULT_SCHEMA=Y4();E ...

42return `+str.trim()+`;

43}());`;return eval(str)||{}}catch($){if(wrap!==!1&&/(unexpected|identifier)/i.test($.message))return parse(str,options,!1);throw SyntaxError($)}},stringify:function(){throw Error("stringifying JavaScript is not supported")}}});var g$=f((nR,v$)=>{/*!

44 * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services.jsView on unpkg · L42

45 *

47 * Released under the MIT License.

48 */v$.exports=function($){if(typeof $==="string"&&$.charAt(0)==="\uFEFF")return $.slice(1);return $}});var G5=f((tV)=>{var h$=g$(),y$=X4();tV.define

49`?$+`

50`:$}});var r$=f(($B,l$)=>{var QW=M4();l$.exports=function($,G){let J=QW(G);if($.data==null)$.data={};if(typeof J.excerpt==="function")return J.excerpt($,J);let X=$.data.excerpt_separator||J.excerpt_separator;if(X==null&&(J.excerpt===!1||J.excerpt==null))return $;let q=typeof J.excerpt==="string"?J.excerpt:X||J.delimiters[0],V=$.content.indexOf(q);if(V!==-1)$.excerpt=$.content.slice(0,V);return $}});var i$=f((GB,c$)=>{var d$=X4(),DW=A6(),w2=G5();c$.exports=function($){if(d$($)!=="object")$={content:$};if(d$($.data)!=="object")$.data={};if($.contents&&$.content==null)$.content=$.contents;return ...

51`+J.delimiters[1],V=$.content;if(J.language)$.language=J.language;let Y=X.length;if(!s$.startsWith(V,X,Y))return a$($,J),$;if(V.charAt(Y)===

52`)$.content=$.content.slice(1)}if(a$($,J),J.sections===!0||typeof J.section==="function")RW($,J.section);return $}C1.engines=OW;C1.stringify=function($,G,J){if(typeof $

53`).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/services.jsView on unpkg · L42

54`+V),$.push(q+"m+"+F5.exports.humanize(this.diff)+"\x1B[0m")}else $[0]=KU()+G+" "+$[0]}function KU(){if(xG.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}function FU(...$){return process.stderr.write(K5.formatWithOptions(xG.inspectOpts,...$)+`

55`)}function RU($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function BU(){return process.env.DEBUG}function OU($){$.inspectOpts={};let G=Object.keys(xG.inspectOpts);for(let J=0;J<G.length;J++)$.inspectOpts[G[J]]=xG.inspectOpts[G[J]]}F5.exports=g6()(xG);var{formatters:bG}=F5.exports;bG.o=function($){return this.inspectOpts.colors=this.useColors,K5.inspect($,this.inspectOpts).split(`

56`).map((G)=>G.trim()).join(" ")};bG.O=function($){return this.inspectOpts.colors=this.useColors,K5.inspect($,this.inspectOpts)}});var gG=f((Oj,f6)=>{if(typeof process>"u"||process.type==="renderer"||!1||process.__nwjs)f6.exports=LG();else f6.exports=vG()});var kJ=f((d_,xJ)=>{var P5=Object.prototype.hasOwnProperty,bJ=Object.prototype.toString,LJ=Object.defineProperty,TJ=Object.getOwnPropertyDescriptor,IJ=function(G){if(typeof Array.isArray==="function")return Array.isArray(G);return bJ.call(G)==="[object Array]"},EJ=function(G){if(!G||bJ.call(G)!=="[object Object]")return!1;var J=P5.call(G,"con ...

57`)}catch{}}}formatJsonEntry($,G,J){let X={ts:new Date().toISOString(),level:$,msg:G};if(this.context)X.ctx=this.context;if(J.length>0)X.data=J;return JSON.stringify(X)}silly($,...G

58`,Nfr:"\uD835\uDD11",NoBreak:"\u2060",NonBreakingSpace:"\xA0",Nopf:"\u2115",Not:"\u2AEC",NotCongruent:"\u2262",NotCupCap:"\u226D",NotDoubleVerticalBar:"\u2226",NotElement:"\u2209",NotEqual:"\u2260",NotEqualTilde:"\u2242\u0338",NotExists:"\u2204",NotGreater:"\u226F",NotGreaterEqual:"\u2271",NotGreaterFullEqual:"\u2267\u0338",NotGreaterGreater:"\u226B\u0338",NotGreaterLess:"\u2279",NotGreaterSlantEqual:"\u2A7E\u0338",NotGreaterTilde:"\u2275",NotHumpDownHump:"\u224E\u0338",NotHumpEqual:"\u224F\u0338",NotLeftTriangle:"\u22EA",NotLeftTriangleBar:"

59`,cr:"\r",space:" ",exclamationMark:"!",quotationMark:'"',numberSign:"#",dollarSign:"$",percentSign:"%",ampersand:"&",apostrophe:"'",leftParenthesis:"(",rightParenthesis:")",asterisk:"*"

60`&&O5(J.stack,J.unsafe[q]))return/[ \t]/.test(X.before)?"":" ";return"\\\n"}function aG($,G){let J=String($),X=J.indexOf(G),q=X,V=0,Y=0;if(typeof G!=="string")throw TypeError("Expected substring");while(X!==-1){if(X===q){if(++V>Y)Y=V}else V=1;q=X+G.length,X=J.indexOf(G,q)}return Y}function O4($,G){return Boolean(G.options.fences===!1&&$.value&&!$.lang&&/[^ \r\n]/.test($.value)&&!/^[\t ]*(?:[\r\n]|$)|(?:^|[\r\n])[\t ]*$/.test($.value))}function sG($){let G=$.options.fence||"`";if(G!=="`"&&G!=="~")throw Error("Cannot serialize code with `"+G+"` for `options.fence`, expected `` ` `` or `~`");retu ...

61`,encode:["`"],...W.current()})),D()}if(M+=W.move(`

62`),V)M+=W.move(V+`

Long lines were clipped for display.

dist/site.jsView file

189</rss>`}var $I=p((ua0,wI)=>{class ej{constructor(w={}){if(!(w.maxSize&&w.maxSize>0))throw TypeError("`maxSize` must be a number greater than 0");if(typeof w.maxAge==="number"&&w.ma... L190: GFS4: `),console.error(w)};if(!c1[L2]){if(rF=global[L2]||[],MI(c1,rF),c1.close=function(w){function $(f,X){return w.call(c1,f,function(W){if(!W)zI();if(typeof X==="function")X.appl... L191: `).filter(Boolean))Y.log(` ${k}`)}return J()}return J(q)}if(O===K)return J();if(Z&&Y.fileDependencies)Y.fileDependencies.add(Z);let B={...W,path:O,request:h,ignoreSymlinks:!0,full...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/site.jsView on unpkg · L189

327Defaulting to 2020, but this will stop working in the future.`)),Q.ecmaVersion=11):Q.ecmaVersion>=2015&&(Q.ecmaVersion-=2009),Q.allowReserved==null&&(Q.allowReserved=Q.ecmaVersion<... L328: `,M-1)+1,this.curLine=this.input.slice(0,this.lineStart).split(o).length):(this.pos=this.lineStart=0,this.curLine=1),this.type=v.eof,this.value=null,this.start=this.end=this.pos,th... L329: `),cooked:null}):M.value={raw:this.input.slice(this.start,this.end).replace(/\r\n?/g,`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/site.jsView on unpkg · L327

dist/ui/app.jsView file

•path = dist/ui/app.js kind = oversized_source_file sizeBytes = 14381909 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/app.jsView on unpkg

dist/brain.jsView file

•path = dist/brain.js kind = oversized_cli_entrypoint sizeBytes = 7208583 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/brain.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/services.jsView file

42return `+str.trim()+`; L43: }());`;return eval(str)||{}}catch($){if(wrap!==!1&&/(unexpected|identifier)/i.test($.message))return parse(str,options,!1);throw SyntaxError($)}},stringify:function(){throw Error("... L44: * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string> L45: * ... L51: `+J.delimiters[1],V=$.content;if(J.language)$.language=J.language;let Y=X.length;if(!s$.startsWith(V,X,Y))return a$($,J),$;if(V.charAt(Y)===X.slice(-1))return $;V=V.slice(Y);let W=... L52: `)$.content=$.content.slice(1)}if(a$($,J),J.sections===!0||typeof J.section==="function")RW($,J.section);return $}C1.engines=OW;C1.stringify=function($,G,J){if(typeof $==="string")... L53: `).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/services.jsView on unpkg · L42

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services.jsView on unpkg · L42

dist/site.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/site.jsView on unpkg · L189

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/site.jsView on unpkg · L327

dist/ui/app.jsView file

•path = dist/ui/app.js kind = oversized_source_file sizeBytes = 14381909 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/app.jsView on unpkg

dist/brain.jsView file

•path = dist/brain.js kind = oversized_cli_entrypoint sizeBytes = 7208583 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/brain.jsView on unpkg

Findings

5 High6 Medium6 Low

HighChild Process

HighSame File Env Network Executiondist/services.js

HighObfuscated Payload Loaderdist/site.js

HighObfuscated

HighOversized Source Filedist/ui/app.js

MediumDynamic Requiredist/site.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/brain.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/services.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/services.jsView file

Lines 22-62javascript

22`,V?1+H:H);else if(U)U=!1,$.result+=K0.repeat(`

23`,H+1);else if(H===0){if(V)$.result+=" "}else $.result+=K0.repeat(`

24`,H);else $.result+=K0.repeat(`

27`,X),q===-1)Y=$.slice(X),X=W;else Y=$.slice(X,q+1),X=q+1;if(Y.length&&Y!==`

28`)V+=J;V+=Y}return V}function M6($,G){return`

30`,q=X&&($[$.length-2]===`

31`||$===`

32`),V=q?"+":X?"":"-";return J+V+`

33`}function D$($){return $[$.length-1]===`

34`?$.slice(0,-1):$}function OV($,G){var J=/(\n+)([^\n]*)/g,X=function(){var U=$.indexOf(`

35`);return U=U!==-1?U:$.length,J.lastIndex=U,z$($.slice(0,U),G)}(),q=$[0]===`

36`||$[0]===" ",V,Y;while(Y=J.exec($)){var W=Y[1],H=Y[2];V=H[0]===" ",X+=W+(!q&&!V

37`:"")+z$(H,G),q=V}return X}function z$($,G){if($===""||$[0]===" ")return $;var J=/ [^ ]/g,X,q

38`+$.slice(q,V),q=V+1;Y=W}if(H+=`

39`,$.length-q>G&&Y>q)H+=$.slice(q,Y)+`

40`+$.slice(Y+1);else H+=$.slice(q);return H.slice(1)}function AV($){var G="",J,X,q;for(var V=0;V<$.length

42return `+str.trim()+`;

44 * strip-bom-string <https://github.com/jonschlinkert/strip-bom-string>

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/services.jsView on unpkg · L42

45 *

47 * Released under the MIT License.

48 */v$.exports=function($){if(typeof $==="string"&&$.charAt(0)==="\uFEFF")return $.slice(1);return $}});var G5=f((tV)=>{var h$=g$(),y$=X4();tV.define

49`?$+`

51`+J.delimiters[1],V=$.content;if(J.language)$.language=J.language;let Y=X.length;if(!s$.startsWith(V,X,Y))return a$($,J),$;if(V.charAt(Y)===

52`)$.content=$.content.slice(1)}if(a$($,J),J.sections===!0||typeof J.section==="function")RW($,J.section);return $}C1.engines=OW;C1.stringify=function($,G,J){if(typeof $

53`).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/services.jsView on unpkg · L42

57`)}catch{}}}formatJsonEntry($,G,J){let X={ts:new Date().toISOString(),level:$,msg:G};if(this.context)X.ctx=this.context;if(J.length>0)X.data=J;return JSON.stringify(X)}silly($,...G

59`,cr:"\r",space:" ",exclamationMark:"!",quotationMark:'"',numberSign:"#",dollarSign:"$",percentSign:"%",ampersand:"&",apostrophe:"'",leftParenthesis:"(",rightParenthesis:")",asterisk:"*"

61`,encode:["`"],...W.current()})),D()}if(M+=W.move(`

62`),V)M+=W.move(V+`

Long lines were clipped for display.

dist/site.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/site.jsView on unpkg · L189

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/site.jsView on unpkg · L327

dist/ui/app.jsView file

•path = dist/ui/app.js kind = oversized_source_file sizeBytes = 14381909 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/app.jsView on unpkg

dist/brain.jsView file

•path = dist/brain.js kind = oversized_cli_entrypoint sizeBytes = 7208583 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/brain.jsView on unpkg