registry / @selesai/code / 0.3.0

@selesai/code@0.3.0

Selesai coding agent

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 471 file(s), 4.51 MB of source, external domains: 127.0.0.1, api-dashboard.search.brave.com, api.anthropic.com, api.github.com, api.search.brave.com, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, distro.ibiblio.org, example.com, git-scm.com, github.com, gitlab.com, html.duckduckgo.com, mariozechner.at, mistral.ai, pi.dev, shittycodingagent.ai, token-in.selesai.in

Source & flagged code

6 flagged

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/extensions/loader.jsView file

Lines 32-72javascript

32 "typebox/value": _bundledTypeboxValue,

33 "@sinclair/typebox": _bundledTypebox,

34 "@sinclair/typebox/compile": _bundledTypeboxCompile,

35 "@sinclair/typebox/value": _bundledTypeboxValue,

36 "@earendil-works/pi-agent-core": _bundledPiAgentCore,

37 "@earendil-works/pi-tui": _bundledPiTui,

38 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

dist/extensions/copy-turn.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

3import { copyToClipboard } from "@selesai/code";

4import { Text } from "@earendil-works/pi-tui";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg

dist/config.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @selesai/code@0.2.1 matchedIdentity = npm:QHNlbGVzYWkvY29kZQ:0.2.1 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config.jsView on unpkg

Source & flagged code

6 flagged · loading source

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

52}; L53: const require = createRequire(import.meta.url); L54: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L52

dist/extensions/copy-turn.tsView file

1import { createHash } from "node:crypto"; L2: import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg

dist/config.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config.jsView on unpkg

Findings

1 High6 Medium7 Low

HighPrevious Version Dangerous Deltadist/config.js

MediumDynamic Requiredist/core/extensions/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperdist/extensions/hooks/ponytail-statusline.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowWeak Cryptodist/extensions/copy-turn.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/extensions/loader.jsView file

Lines 32-72javascript

32 "typebox/value": _bundledTypeboxValue,

33 "@sinclair/typebox": _bundledTypebox,

34 "@sinclair/typebox/compile": _bundledTypeboxCompile,

35 "@sinclair/typebox/value": _bundledTypeboxValue,

36 "@earendil-works/pi-agent-core": _bundledPiAgentCore,

37 "@earendil-works/pi-tui": _bundledPiTui,

38 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

dist/extensions/copy-turn.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

3import { copyToClipboard } from "@selesai/code";

4import { Text } from "@earendil-works/pi-tui";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg

dist/config.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/config.jsView on unpkg