registry / @saluzi/saluzi-edu / 0.1.108

@saluzi/saluzi-edu@0.1.108

Saluzi CLI - interactive AI coding assistant in the terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 168 file(s), 9.17 MB of source, external domains: 127.0.0.1, api.anthropic.com, cdn.jsdelivr.net, chevrotain.io, docs.anthropic.com, docs.expo.dev, en.wikipedia.org, example.com, ghproxy.net, github.com, jquery.org, langium.org, lodash.com, nodejs.org, openjsf.org, platform.claude.com, radix-ui.com, react.dev, registry.npmjs.org, tldrlegal.com, underscorejs.org, www.ibm.com, www.w3.org

Oversized source lightweight scan

dist/cli.js19.1 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsapi.anthropic.comdocs.anthropic.comdocs.expo.devgithub.comnodejs.orgplatform.claude.com

dist/rcs-web/assets/shiki-mEP5vQQu.js9.14 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

packages/remote-control-server/web/dist/assets/shiki-mEP5vQQu.js9.14 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

Source & flagged code

10 flagged

package.jsonView file

Lines 39-79json

39 "build:vite:only": "vite build",

40 "build:bun": "bun run build.ts",

41 "dev": "bun run scripts/dev.ts",

42 "dev:inspect": "bun run scripts/dev-debug.ts",

43 "parade": "bun run scripts/dev.ts parade",

44 "prepublishOnly": "bun run build:vite",

45 "lint": "biome lint .",

46 "lint:fix": "biome lint --fix .",

47 "format": "biome format --write .",

48 "check": "biome check .",

49 "check:fix": "biome check --fix .",

50 "prepare": "husky",

51 "test": "bun test --isolate",

52 "test:production": "bun run scripts/production-test.ts",

53 "test:production:offline": "bun run scripts/production-test.ts --offline",

54 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

55 "test:production:bun": "bun run scripts/production-test.ts --bun",

56 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

57 "check:unused": "knip-bun",

58 "health": "bun run scripts/health-check.ts",

59 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "docs:dev": "npx mintlify dev",

61 "typecheck": "tsc --noEmit",

62 "precheck": "bun run typecheck && bun run check:fix && bun test --isolate",

63 "rcs": "bun run scripts/rcs.ts",

64 "smoke-test": "node scripts/smoke-test.mjs",

65 "smoke-test:quick": "node scripts/smoke-test.mjs --skip-build"

66 },

67 "dependencies": {

68 "@agentclientprotocol/sdk": "^0.19.0",

69 "@saluzi/codegraph": "^0.2.3",

70 "@saluzi/sa-agent-tools": "^1.0.0",

71 "@saluzi/sa-builtin-tools": "^1.0.1",

72 "figlet": "^1.11.0",

73 "highlight.js": "^11.11.1",

74 "tree-sitter-wasms": "^0.1.0",

75 "web-tree-sitter": "^0.25.3",

76 "ws": "^8.20.0"

77 },

78 "devDependencies": {

79 "@alcalzone/ansi-tokenize": "^0.3.0",

scripts/postinstall.cjsView file

Lines 3-43javascript

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/rcs-web/assets/shiki-mEP5vQQu.jsView file

•path = dist/rcs-web/assets/shiki-mEP5vQQu.js kind = oversized_source_file sizeBytes = 9583817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/rcs-web/assets/shiki-mEP5vQQu.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 20070118 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

23Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L23: } = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L190: } L191: return Buffer.from(await response.arrayBuffer())

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.cjsView on unpkg · L23

23} = require('fs') L24: const { spawnSync } = require('child_process') L25: const { setDefaultResultOrder } = require('node:dns') L26: const path = require('path') ... L41: const RELEASE_BASE = ( L42: process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE L43: ).replace(/\/$/, '') ... L50: function getPlatformMapping() { L51: const arch = process.arch L52: const platform = process.platform ... L190: } L191: return Buffer.from(await response.arrayBuffer())

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L23

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L23

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/rcs-web/assets/shiki-mEP5vQQu.jsView file

•path = dist/rcs-web/assets/shiki-mEP5vQQu.js kind = oversized_source_file sizeBytes = 9583817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/rcs-web/assets/shiki-mEP5vQQu.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 20070118 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Findings

6 High8 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/postinstall.cjs

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighInstall Named Payload Filescripts/postinstall.cjs

HighShips High Entropy Blobdist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/rcs-web/assets/shiki-mEP5vQQu.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/vendor/audio-capture/x64-darwin/audio-capture.node

MediumShips Wasm Moduledist/tree-sitter.wasm

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

10 flagged

package.jsonView file

Lines 39-79json

39 "build:vite:only": "vite build",

40 "build:bun": "bun run build.ts",

41 "dev": "bun run scripts/dev.ts",

42 "dev:inspect": "bun run scripts/dev-debug.ts",

43 "parade": "bun run scripts/dev.ts parade",

44 "prepublishOnly": "bun run build:vite",

45 "lint": "biome lint .",

46 "lint:fix": "biome lint --fix .",

47 "format": "biome format --write .",

48 "check": "biome check .",

49 "check:fix": "biome check --fix .",

50 "prepare": "husky",

51 "test": "bun test --isolate",

52 "test:production": "bun run scripts/production-test.ts",

53 "test:production:offline": "bun run scripts/production-test.ts --offline",

54 "test:production:verbose": "bun run scripts/production-test.ts --verbose",

55 "test:production:bun": "bun run scripts/production-test.ts --bun",

56 "check:bundle": "bun run scripts/check-bundle-integrity.ts",

57 "check:unused": "knip-bun",

58 "health": "bun run scripts/health-check.ts",

59 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "docs:dev": "npx mintlify dev",

61 "typecheck": "tsc --noEmit",

62 "precheck": "bun run typecheck && bun run check:fix && bun test --isolate",

63 "rcs": "bun run scripts/rcs.ts",

64 "smoke-test": "node scripts/smoke-test.mjs",

65 "smoke-test:quick": "node scripts/smoke-test.mjs --skip-build"

66 },

67 "dependencies": {

68 "@agentclientprotocol/sdk": "^0.19.0",

69 "@saluzi/codegraph": "^0.2.3",

70 "@saluzi/sa-agent-tools": "^1.0.0",

71 "@saluzi/sa-builtin-tools": "^1.0.1",

72 "figlet": "^1.11.0",

73 "highlight.js": "^11.11.1",

74 "tree-sitter-wasms": "^0.1.0",

75 "web-tree-sitter": "^0.25.3",

76 "ws": "^8.20.0"

77 },

78 "devDependencies": {

79 "@alcalzone/ansi-tokenize": "^0.3.0",

scripts/postinstall.cjsView file

Lines 3-43javascript

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/tree-sitter.wasmView file

•path = dist/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/tree-sitter.wasmView on unpkg

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/rcs-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/rcs-web/assets/shiki-mEP5vQQu.jsView file

•path = dist/rcs-web/assets/shiki-mEP5vQQu.js kind = oversized_source_file sizeBytes = 9583817 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/rcs-web/assets/shiki-mEP5vQQu.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 20070118 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg