registry  /  @sailresearch/code  /  0.1.3

@sailresearch/code@0.1.3

Run Claude Code on GLM-5.2 via Sail — one command, no Anthropic account.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 8 file(s), 93.0 KB of source, external domains: 127.0.0.1, api.sailresearch.com, app.sailresearch.com, dev.sailresearch.com, docs.sailresearch.com, staging.sailresearch.com

Source & flagged code

3 flagged · loading source
src/run.jsView file
9import path from "node:path"; L10: import { spawn } from "node:child_process"; L11:
High
Child Process

Package source references child process execution.

src/run.jsView on unpkg · L9
74// target on PATH ourselves: .exe/.com spawn directly; .cmd/.bat go through L75: // cmd.exe with cross-spawn's escaping (shell:true would join args unescaped). L76:
High
Shell

Package source references shell execution.

src/run.jsView on unpkg · L74
69// L70: // `npm install -g @anthropic-ai/claude-code` puts `claude.cmd`/`claude.ps1` L71: // shims on PATH on Windows — no claude.exe. CreateProcess only auto-appends L72: // .exe, and Node (post CVE-2024-27980) refuses to spawn .cmd/.bat without a L73: // shell, so a bare spawn("claude") can never work there. We resolve the real L74: // target on PATH ourselves: .exe/.com spawn directly; .cmd/.bat go through
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

src/run.jsView on unpkg · L69

Findings

3 High3 Medium4 Low
HighChild Processsrc/run.js
HighShellsrc/run.js
HighRuntime Package Installsrc/run.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings