registry / @scorehub/creator-outreach / 1.1.11

@scorehub/creator-outreach@1.1.11

ScoreHub AI TikTok达人营销专家 Tiky — Agent 定义 + Skills 配置

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 5.61 KB of source, external domains: app.scorehub.cn, www.workbuddy.cn

Source & flagged code

1 flagged

install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

Source & flagged code

1 flagged · loading source

install.jsView file

5const os = require('os'); L6: const { execSync } = require('child_process'); L7: L8: const pkg = require('./package.json'); L9: const MIN_NODE_MAJOR = 18; L10: const WORKBUDDY_SHARE_URL = 'https://www.workbuddy.cn/work/launch/?sharecode=lNM8H05BRKoV-dw2gac3ZwQ-p01o3C3KVz1gXJ_CwvtX02-mSRqBB3xepE4V0gr7&expertname=Tiky+%C2%B7+TikTok%E8%BE%BE... L11: const CREATOR_OUTREACH_SELF_BOOTSTRAP_COMMAND = 'npx -y @scorehub/creator-outreach@latest'; ... L45: const versionsDir = path.join(workBuddyDir, 'binaries', 'node', 'versions'); L46: const npxExecutable = process.platform === 'win32' ? 'npx.cmd' : 'npx'; L47: try { ... L79: try { L80: config = JSON.parse(fs.readFileSync(configPath, 'utf8'));

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code