registry / @sevoniva/llm-coding-bridge / 0.1.1

@sevoniva/llm-coding-bridge@0.1.1

Local bridge for using OpenAI-compatible chat completion providers with coding clients.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 31.2 KB of source, external domains: www.apple.com

Source & flagged code

2 flagged

bin/llm-coding-bridge.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const http = require("node:http");

6const os = require("node:os");

7const path = require("node:path");

8const { randomUUID } = require("node:crypto");

9const { spawnSync } = require("node:child_process");

10const readline = require("node:readline/promises");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/llm-coding-bridge.jsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/llm-coding-bridge.jsView on unpkg · L4

12const DEFAULT_CONFIG = "llm-coding-bridge.config.json";

14function parseArgs(argv) {

15 const command = argv[0] && !argv[0].startsWith("-") ? argv.shift() : "help";

16 const args = { command, config: DEFAULT_CONFIG, out: DEFAULT_CONFIG, name: "llm-coding-bridge" };

17 if (command === "template" && argv[0] && !argv[0].startsWith("-")) args.template = argv.shift();

18 for (let i = 0; i < argv.length; i += 1) {

19 const arg = argv[i];

20 if (arg === "--config" || arg === "-c") args.config = argv[++i];

21 else if (arg === "--out" || arg === "-o") args.out = argv[++i];

22 else if (arg === "--name") args.name = argv[++i];

23 else if (arg === "--no-doctor") args.doctor = false;

24 else if (arg === "--help" || arg === "-h") args.help = true;

Source & flagged code

2 flagged · loading source

bin/llm-coding-bridge.jsView file

4const fs = require("node:fs"); L5: const http = require("node:http"); L6: const os = require("node:os"); ... L8: const { randomUUID } = require("node:crypto"); L9: const { spawnSync } = require("node:child_process"); L10: const readline = require("node:readline/promises"); ... L43: const configPath = path.resolve(file); L44: const config = JSON.parse(fs.readFileSync(configPath, "utf8")); L45: const server = { host: "127.0.0.1", port: 18080, ...(config.server || {}) }; ... L55: function getApiKey(upstream) { L56: if (upstream.apiKeyEnv && process.env[upstream.apiKeyEnv]) { L57: return process.env[upstream.apiKeyEnv];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/llm-coding-bridge.jsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/llm-coding-bridge.jsView on unpkg · L4

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/llm-coding-bridge.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/llm-coding-bridge.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/llm-coding-bridge.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const http = require("node:http");

6const os = require("node:os");

7const path = require("node:path");

8const { randomUUID } = require("node:crypto");

9const { spawnSync } = require("node:child_process");

10const readline = require("node:readline/promises");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/llm-coding-bridge.jsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/llm-coding-bridge.jsView on unpkg · L4

12const DEFAULT_CONFIG = "llm-coding-bridge.config.json";

14function parseArgs(argv) {

15 const command = argv[0] && !argv[0].startsWith("-") ? argv.shift() : "help";

16 const args = { command, config: DEFAULT_CONFIG, out: DEFAULT_CONFIG, name: "llm-coding-bridge" };

17 if (command === "template" && argv[0] && !argv[0].startsWith("-")) args.template = argv.shift();

18 for (let i = 0; i < argv.length; i += 1) {

19 const arg = argv[i];

20 if (arg === "--config" || arg === "-c") args.config = argv[++i];

21 else if (arg === "--out" || arg === "-o") args.out = argv[++i];

22 else if (arg === "--name") args.name = argv[++i];

23 else if (arg === "--no-doctor") args.doctor = false;

24 else if (arg === "--help" || arg === "-h") args.help = true;