registry / @sigmashake/ssg / 1.0.9

@sigmashake/ssg@1.0.9

AI Agent Governance CLI — evaluate tool calls against rules, block dangerous operations, and surface blocked commands

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 1.35 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.sigmashake.com, api.example.com, bun.sh, docs.sigmashake.com, github.com, hub.sigmashake.com, react.dev, sigmashake.com, www.w3.org

Source & flagged code

2 flagged

package.jsonView file

Lines 5-45json

5 "license": "SEE LICENSE IN LICENSE",

6 "type": "module",

7 "bin": {

8 "ssg": "bin/ssg.cjs"

9 },

10 "files": [

11 "bin/",

12 "public/",

13 "LICENSE",

14 "README.md",

15 "sbom.cdx.json"

16 ],

17 "optionalDependencies": {

18 "@sigmashake/ssg-linux-x64": "1.0.9",

19 "@sigmashake/ssg-linux-arm64": "1.0.9",

20 "@sigmashake/ssg-darwin-arm64": "1.0.9",

21 "@sigmashake/ssg-darwin-x64": "1.0.9",

22 "@sigmashake/ssg-win32-x64": "1.0.9"

23 },

24 "scripts": {

25 "postinstall": "node ./bin/cleanup-globals.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 "gen:api-deprecation": "bun run tools/gen-api-deprecation-catalog.ts",

27 "gen:starter-presets": "bun run tools/gen-starter-presets.ts",

28 "gen:opencode-plugin": "bun run tools/gen-opencode-plugin.ts",

29 "dev": "bun run scripts/dev.ts",

30 "dev:server-only": "SSQA_ATTACH=${SSQA_ATTACH:-1} bun --watch src/serve-dev.ts",

31 "dev:debug": "bun --inspect src/serve-dev.ts",

32 "dev:debug-daemon": "bun --inspect src/cli.ts daemon",

33 "build": "bun run build:client && bun build --compile src/cli.ts --outfile ssg",

34 "build:linux": "bun build --compile --target=bun-linux-x64 src/cli.ts --outfile dist/ssg-linux-x64 && bun run scripts/stage-public-to-dist.ts",

35 "build:macos-arm64": "bun build --compile --target=bun-darwin-arm64 src/cli.ts --outfile dist/ssg-darwin-arm64 && bun run scripts/stage-public-to-dist.ts",

36 "build:macos-x64": "bun build --compile --target=bun-darwin-x64 src/cli.ts --outfile dist/ssg-darwin-x64 && bun run scripts/stage-public-to-dist.ts",

37 "build:macos-universal": "bun run build:macos-arm64 && bun run build:macos-x64 && lipo -create dist/ssg-darwin-arm64 dist/ssg-darwin-x64 -output dist/ssg-darwin-universal && file dist/ssg-darwin-universal",

38 "build:windows": "bun build --compile --target=bun-windows-x64 src/cli.ts --outfile dist/ssg-win32-x64.exe && bun run scripts/stage-public-to-dist.ts",

39 "build:windows-hookw": "bun build --compile --windows-hide-console --target=bun-windows-x64 src/cli.ts --outfile dist/ssg-hookw-win32-x64.exe && bun run scripts/patch-pe-subsystem.ts dist/ssg-hookw-win32-x64.exe && bun run scripts/assert-windowshide-effective.ts && bun run scripts/stage-public-to-dist.ts",

40 "build:linux-arm64": "bun build --compile --target=bun-linux-arm64 src/cli.ts --outfile dist/ssg-linux-arm64 && bun run scripts/stage-public-to-dist.ts",

41 "build:all": "bun run build:linux && bun run build:linux-arm64 && bun run build:macos-arm64 && bun run build:macos-x64 && bun run build:windows && bun run build:windows-hookw",

42 "build:protected:all": "bash ../sigmashake-dist/scripts/build-protected.sh",

43 "pub:platforms": "bash ../sigmashake-dist/scripts/publish-platforms.sh",

44 "prepublishOnly": "bash ../sigmashake-dist/scripts/prepublish-guard.sh",

45 "build:client": "tsc --noEmit -p tsconfig.client.json && vite build",

bin/ssg.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// bin/ssg.cjs — launcher for @sigmashake/ssg

3// Resolves the native binary from the platform-specific optional dependency,

4// falls back to a local dist/ build (dev environment), then to Bun + source.

5"use strict";

7const { execFileSync, spawnSync } = require("node:child_process");

8const path =

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/cleanup-globals.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/ssg.cjsView file

6L7: const { execFileSync, spawnSync } = require("node:child_process"); L8: const path = require("node:path"); ... L10: L11: const ext = process.platform === "win32" ? ".exe" : ""; L12: const platformPkg = `@sigmashake/ssg-${process.platform}-${process.arch}`; ... L24: // install. L25: // b) default (walks UP from __dirname) — the nested copy at L26: // @sigmashake/ssg/node_modules/@sigmashake/ssg-<plat>-<arch>, which npm ... L44: try { L45: return JSON.parse(fs.readFileSync(pkgJsonPath, "utf8")).version; L46: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/ssg.cjsView on unpkg · L6

Findings

2 High3 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitybin/ssg.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License