registry / @seanyao/roll / 4.707.1

@seanyao/roll@4.707.1

Roll — Roll out features with AI agents

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 312 KB of source, external domains: api.github.com

Oversized source lightweight scan

dist/roll.mjs12.2 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalCryptoShellDynamicRequireHighEntropyStringsUrlStringsapi.github.com

Source & flagged code

11 flagged

package.jsonView file

Lines 1-33json

2 "name": "@seanyao/roll",

3 "version": "4.707.1",

4 "description": "Roll — Roll out features with AI agents",

5 "packageManager": "pnpm@11.1.3",

6 "scripts": {

7 "test": "bash scripts/test-ts.sh",

8 "lint:story-ids": "node scripts/lint-story-ids.mjs",

9 "lint:role-taxonomy": "node scripts/audit-role-taxonomy.mjs",

10 "test:e2e": "pnpm -r build && pnpm --filter @roll/cli exec vitest run test/critical-flows.e2e.test.ts",

11 "test:cov": "pnpm -r exec vitest run --coverage.enabled --coverage.provider=v8 --coverage.include='src/**' --coverage.reporter=text-summary --coverage.reporter=text",

12 "bundle": "node scripts/bundle.mjs",

13 "postinstall": "node scripts/postinstall-roll-capture.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "prepack": "pnpm -r build && pnpm bundle"

15 },

16 "keywords": [

17 "ai",

18 "agent",

19 "development-workflow",

20 "skills",

21 "agent-first"

22 ],

23 "homepage": "https://github.com/seanyao/roll",

24 "repository": {

25 "type": "git",

26 "url": "git+https://github.com/seanyao/roll.git"

27 },

28 "bin": {

29 "roll": "dist/roll.mjs"

30 },

31 "license": "MIT",

32 "author": "Sean Yao <sean.dlut@gmail.com>",

33 "files": [

dist/postinstall.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { createRequire as __rollCreateRequire } from 'node:module';

3import { fileURLToPath as __rollFileURLToPath } from 'node:url';

4import { dirname as __rollDirname } from 'node:path';

5const require = __rollCreateRequire

lib/agent_usage/kimi_emit.pyView file

•path = lib/agent_usage/kimi_emit.py kind = build_helper sizeBytes = 4309 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/agent_usage/kimi_emit.pyView on unpkg

dist/roll.mjsView file

•path = dist/roll.mjs kind = oversized_source_file sizeBytes = 12784550 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/roll.mjsView on unpkg

•path = dist/roll.mjs kind = oversized_cli_entrypoint sizeBytes = 12784550 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/roll.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-roll-capture.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/postinstall.mjsView file

9// packages/cli/src/lib/roll-capture-install.ts L10: import { spawnSync } from "node:child_process"; L11: import {

High

Child Process

Package source references child process execution.

dist/postinstall.mjsView on unpkg · L9

315// packages/cli/src/lib/roll-capture-install.ts L316: var RELEASE_API = "https://api.github.com/repos/seanyao/roll-capture/releases/latest"; L317: var ASSET_NAME = "Roll-Capture.app.zip"; ... L323: function defaultRollCaptureInstallDeps() { L324: const platform = externalPlatformOverride(process.env["_ROLL_EXTERNAL_TOOLS_PLATFORM"]) ?? process.platform; L325: const execFile = (cmd, args, opts) => { L326: const r = spawnSync(cmd, [...args], { L327: cwd: opts?.cwd,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall.mjsView on unpkg · L315

6const __filename = __rollFileURLToPath(import.meta.url); L7: const __dirname = __rollDirname(__filename); L8: L9: // packages/cli/src/lib/roll-capture-install.ts L10: import { spawnSync } from "node:child_process"; L11: import { ... L315: // packages/cli/src/lib/roll-capture-install.ts L316: var RELEASE_API = "https://api.github.com/repos/seanyao/roll-capture/releases/latest"; L317: var ASSET_NAME = "Roll-Capture.app.zip"; ... L323: function defaultRollCaptureInstallDeps() { L324: const platform = externalPlatformOverride(process.env["_ROLL_EXTERNAL_TOOLS_PLATFORM"]) ?? process.platform; L325: const execFile = (cmd, args, opts) => {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.mjsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @seanyao/roll@4.703.2 matchedIdentity = npm:QHNlYW55YW8vcm9sbA:4.703.2 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/postinstall.mjsView on unpkg

4import { dirname as __rollDirname } from 'node:path'; L5: const require = __rollCreateRequire(import.meta.url); L6: const __filename = __rollFileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/postinstall.mjsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/postinstall.mjsView on unpkg · L6

647} L648: var optionalImport = new Function("specifier", "return import(specifier)"); L649: function enableNodeGlobalProxyFromEnv(env) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/postinstall.mjsView on unpkg · L647

lib/agent_usage/kimi_emit.pyView file

•path = lib/agent_usage/kimi_emit.py kind = build_helper sizeBytes = 4309 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/agent_usage/kimi_emit.pyView on unpkg

dist/roll.mjsView file

•path = dist/roll.mjs kind = oversized_source_file sizeBytes = 12784550 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/roll.mjsView on unpkg

•path = dist/roll.mjs kind = oversized_cli_entrypoint sizeBytes = 12784550 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/roll.mjsView on unpkg

Findings

7 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/postinstall.mjs

HighShell

HighSame File Env Network Executiondist/postinstall.mjs

HighSandbox Evasion Gated Capabilitydist/postinstall.mjs

HighOversized Source Filedist/roll.mjs

HighPrevious Version Dangerous Deltadist/postinstall.mjs

MediumDynamic Requiredist/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/postinstall.mjs

MediumShips Build Helperlib/agent_usage/kimi_emit.py

MediumOversized Cli Entrypointdist/roll.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/postinstall.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

package.jsonView file

Lines 1-33json

2 "name": "@seanyao/roll",

3 "version": "4.707.1",

4 "description": "Roll — Roll out features with AI agents",

5 "packageManager": "pnpm@11.1.3",

6 "scripts": {

7 "test": "bash scripts/test-ts.sh",

8 "lint:story-ids": "node scripts/lint-story-ids.mjs",

9 "lint:role-taxonomy": "node scripts/audit-role-taxonomy.mjs",

10 "test:e2e": "pnpm -r build && pnpm --filter @roll/cli exec vitest run test/critical-flows.e2e.test.ts",

11 "test:cov": "pnpm -r exec vitest run --coverage.enabled --coverage.provider=v8 --coverage.include='src/**' --coverage.reporter=text-summary --coverage.reporter=text",

12 "bundle": "node scripts/bundle.mjs",

13 "postinstall": "node scripts/postinstall-roll-capture.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

14 "prepack": "pnpm -r build && pnpm bundle"

15 },

16 "keywords": [

17 "ai",

18 "agent",

19 "development-workflow",

20 "skills",

21 "agent-first"

22 ],

23 "homepage": "https://github.com/seanyao/roll",

24 "repository": {

25 "type": "git",

26 "url": "git+https://github.com/seanyao/roll.git"

27 },

28 "bin": {

29 "roll": "dist/roll.mjs"

30 },

31 "license": "MIT",

32 "author": "Sean Yao <sean.dlut@gmail.com>",

33 "files": [

dist/postinstall.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { createRequire as __rollCreateRequire } from 'node:module';

3import { fileURLToPath as __rollFileURLToPath } from 'node:url';

4import { dirname as __rollDirname } from 'node:path';

5const require = __rollCreateRequire

lib/agent_usage/kimi_emit.pyView file

•path = lib/agent_usage/kimi_emit.py kind = build_helper sizeBytes = 4309 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/agent_usage/kimi_emit.pyView on unpkg

dist/roll.mjsView file

•path = dist/roll.mjs kind = oversized_source_file sizeBytes = 12784550 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/roll.mjsView on unpkg

•path = dist/roll.mjs kind = oversized_cli_entrypoint sizeBytes = 12784550 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/roll.mjsView on unpkg

Lines 295-335javascript

295// packages/cli/src/lib/roll-capture-readiness.ts

296import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";

297import { dirname, join } from "node:path";

298var APP_NAME = "Roll Capture.app";

299var ROLL_CAPTURE_POSITIVE_READINESS_TTL_MS = 30 * 60 * 1e3;

300var ROLL_CAPTURE_NEGATIVE_READINESS_TTL_MS = 60 * 1e3;

301function detectCanonicalRollCaptureInstall(deps) {

302 for (const candidate of [join(deps.home, "Applications", APP_NAME), join("/Applications", APP_NAME)]) {

303 if (deps.exists(candidate)) return { status: "installed", path: candidate };

304 }

305 return { status: "missing" };

306}

307function rollCaptureReadinessCachePath(deps) {

308 const rollHome = (deps.env["ROLL_HOME"] ?? "").trim() || join(deps.home, ".roll");

309 return join(rollHome, "cache", "roll-capture-readiness.json");

310}

311function invalidateRollCaptureReadinessCache(deps) {

312 rmSync(rollCaptureReadinessCachePath(deps), { force: true });

313}

314

315// packages/cli/src/lib/roll-capture-install.ts

316var RELEASE_API = "https://api.github.com/repos/seanyao/roll-capture/releases/latest";

317var ASSET_NAME = "Roll-Capture.app.zip";

318var APP_NAME2 = "Roll Capture.app";

319var DOWNLOAD_TIMEOUT_MS = 6e4;

320var UPDATE_HINT_TIMEOUT_MS = 1500;

321var GH_AUTH_TOKEN_TIMEOUT_MS = 5e3;

322var ROOT_INSTALL_SKIP_REASON = "run roll setup as a regular user to install Roll Capture.app";

323function defaultRollCaptureInstallDeps() {

324 const platform = externalPlatformOverride(process.env["_ROLL_EXTERNAL_TOOLS_PLATFORM"]) ?? process.platform;

325 const execFile = (cmd, args, opts) => {

326 const r = spawnSync(cmd, [...args], {

327 cwd: opts?.cwd,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall.mjsView on unpkg · L315

328 encoding: "utf8",

329 stdio: ["ignore", "pipe", "pipe"],

330 timeout: opts?.timeoutMs ?? 15e3

331 });

332 return { code: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };

333 };

334 return {

335 platform,