registry / @sohaha/zcc / 0.0.3

@sohaha/zcc@0.0.3

App for agentic coding - access coding agent anywhere

Static Scan Results

scanned 13h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

Manifest

CopyleftLicense

scanned 1 file(s), 4.35 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 16-56json

16 "zcc": "bin/zcc.cjs"

17 },

18 "files": [

19 "bin/zcc.cjs",

20 "NOTICE"

21 ],

22 "imports": {

23 "#embedded-assets": {

24 "bun": "./src/runtime/embeddedAssets.bun.ts",

25 "default": "./src/runtime/embeddedAssets.stub.ts"

26 }

27 },

28 "optionalDependencies": {

29 "@sohaha/zcc-darwin-arm64": "0.0.3",

30 "@sohaha/zcc-darwin-x64": "0.0.3",

31 "@sohaha/zcc-linux-arm64": "0.0.3",

32 "@sohaha/zcc-linux-x64": "0.0.3",

33 "@sohaha/zcc-win32-x64": "0.0.3"

34 },

35 "scripts": {

36 "postinstall": "node -e \"try{require('fs').chmodSync(require('path').join(__dirname,'bin','zcc.cjs'),0o755)}catch(e){}\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "typecheck": "tsc --noEmit",

38 "build:exe": "bun run scripts/build-executable.ts",

39 "build:exe:all": "bun run scripts/build-executable.ts --all",

40 "build:exe:allinone": "bun run scripts/build-executable.ts --with-web-assets",

41 "build:exe:allinone:all": "bun run scripts/build-executable.ts --with-web-assets --all",

42 "obfuscate": "javascript-obfuscator bin/zcc.cjs --output bin/zcc.cjs --compact true --string-array true --string-array-encoding base64",

43 "prepare-npm-packages": "bun run scripts/prepare-npm-packages.ts",

44 "prepack": "bun run prepare-npm-packages",

45 "tools:unpack": "bun run scripts/unpack-tools.ts",

46 "update-homebrew-formula": "bun run scripts/update-homebrew-formula.ts",

47 "test": "bun run tools:unpack && vitest run",

48 "test:win": "vitest run",

49 "dev": "bun src/index.ts",

50 "dev:local-server": "bun --env-file .env.dev-local-server src/index.ts",

51 "dev:integration-test-env": "bun --env-file .env.integration-test src/index.ts",

52 "release-all": "bun run scripts/release-all.ts"

53 },

54 "dependencies": {

55 "@zcc/protocol": "workspace:*",

56 "zcc-hub": "workspace:*",

bin/zcc.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execFileSync } = require('child_process');

4const path = require('path');

6const

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('fs').chmodSync(require('path').join(__dirname,'bin','zcc.cjs'),0o755)}catch(e){}"

High

Install Time Lifecycle Scripts

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code