registry / @selesai/code / 0.4.0

@selesai/code@0.4.0

Selesai coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 503 file(s), 4.93 MB of source, external domains: 127.0.0.1, api-dashboard.search.brave.com, api.anthropic.com, api.github.com, api.search.brave.com, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, distro.ibiblio.org, example.com, git-scm.com, github.com, gitlab.com, html.duckduckgo.com, mariozechner.at, mistral.ai, pi.dev, registry.npmjs.org, shittycodingagent.ai, token-in.selesai.in

Source & flagged code

8 flagged

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

6/**

7 * Execute a shell command and return stdout/stderr/code.

8 * Supports timeout and abort signal.

9 */

10export async function execCommand(command, args, cwd, options) {

11 return new Promise((resolve) => {

12 const proc = spawn(command, args, {

13 cwd,

14 shell: false,

15 stdio: ["ignore", "pipe", "pipe"],

16 });

17 let stdout = "";

18 let stderr = "";

19 let killed = false;

20 let timeoutId;

21 const killProcess = () => {

22 if (!killed) {

23 killed = true;

dist/utils/tools-manager.jsView file

Lines 166-206javascript

166}

167function getWindowsTarCommand() {

168 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

169 if (systemRoot) {

170 const systemTar = join(systemRoot, "System32", "tar.exe"

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 33-73javascript

33 "typebox/value": _bundledTypeboxValue,

34 "@sinclair/typebox": _bundledTypebox,

35 "@sinclair/typebox/compile": _bundledTypeboxCompile,

36 "@sinclair/typebox/value": _bundledTypeboxValue,

37 "@earendil-works/pi-agent-core": _bundledPiAgentCore,

38 "@earendil-works/pi-tui": _bundledPiTui,

39 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

dist/extensions/copy-turn.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

3import { copyToClipboard } from "@selesai/code";

4import { Text } from "@earendil-works/pi-tui";

dist/extensions/pi-subagents/install.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * pi-subagents installer

5 *

6 * Usage:

7 * npx pi-subagents # Install to ~/.pi/agent/extensions/subagent

8 * npx pi-subagents --remove # Remove the extension

9 */

11import { execSync } from "node:child_process";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg

Source & flagged code

8 flagged · loading source

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/utils/tools-manager.jsView file

186const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }"; L187: const powershellFailure = runExtractionCommand("powershell.exe", [ L188: "-NoLogo",

High

Shell

Package source references shell execution.

dist/utils/tools-manager.jsView on unpkg · L186

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

53}; L54: const require = createRequire(import.meta.url); L55: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L53

dist/extensions/copy-turn.tsView file

1import { createHash } from "node:crypto"; L2: import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

dist/extensions/pi-subagents/install.mjsView file

6* Usage: L7: * npx pi-subagents # Install to ~/.pi/agent/extensions/subagent L8: * npx pi-subagents --remove # Remove the extension ... L10: L11: import { execSync } from "node:child_process"; L12: import * as fs from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/extensions/pi-subagents/install.mjsView on unpkg · L6

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg

Findings

3 High6 Medium7 Low

HighChild Processdist/core/exec.js

HighShelldist/utils/tools-manager.js

HighRuntime Package Installdist/extensions/pi-subagents/install.mjs

MediumDynamic Requiredist/core/extensions/loader.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperdist/extensions/hooks/ponytail-statusline.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowWeak Cryptodist/extensions/copy-turn.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

6/**

7 * Execute a shell command and return stdout/stderr/code.

8 * Supports timeout and abort signal.

9 */

10export async function execCommand(command, args, cwd, options) {

11 return new Promise((resolve) => {

12 const proc = spawn(command, args, {

13 cwd,

14 shell: false,

15 stdio: ["ignore", "pipe", "pipe"],

16 });

17 let stdout = "";

18 let stderr = "";

19 let killed = false;

20 let timeoutId;

21 const killProcess = () => {

22 if (!killed) {

23 killed = true;

dist/utils/tools-manager.jsView file

Lines 166-206javascript

166}

167function getWindowsTarCommand() {

168 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

169 if (systemRoot) {

170 const systemTar = join(systemRoot, "System32", "tar.exe"

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/core/extensions/loader.jsView file

Lines 33-73javascript

33 "typebox/value": _bundledTypeboxValue,

34 "@sinclair/typebox": _bundledTypebox,

35 "@sinclair/typebox/compile": _bundledTypeboxCompile,

36 "@sinclair/typebox/value": _bundledTypeboxValue,

37 "@earendil-works/pi-agent-core": _bundledPiAgentCore,

38 "@earendil-works/pi-tui": _bundledPiTui,

39 // Extensions resolve the pi-ai root to the compat entrypoint (a strict

dist/extensions/copy-turn.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import type { ExtensionAPI } from "@selesai/code";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/extensions/copy-turn.tsView on unpkg · L1

3import { copyToClipboard } from "@selesai/code";

4import { Text } from "@earendil-works/pi-tui";

dist/extensions/pi-subagents/install.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * pi-subagents installer

5 *

6 * Usage:

7 * npx pi-subagents # Install to ~/.pi/agent/extensions/subagent

8 * npx pi-subagents --remove # Remove the extension

9 */

11import { execSync } from "node:child_process";

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

dist/extensions/hooks/ponytail-statusline.ps1View file

•path = dist/extensions/hooks/ponytail-statusline.ps1 kind = build_helper sizeBytes = 664 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/extensions/hooks/ponytail-statusline.ps1View on unpkg