registry / @sohaha/zcc / 0.0.2

@sohaha/zcc@0.0.2

App for agentic coding - access coding agent anywhere

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

Manifest

CopyleftLicense

scanned 1 file(s), 4.35 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

1 flagged

bin/zcc.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execFileSync } = require('child_process');

4const path = require('path');

6const platform = process.platform;

7const arch = process.arch;

8const RELEASE_URL = 'https://github.com/tiann/zcc/releases';

9const OFFICIAL_NPM_REGISTRY = 'https://registry.npmjs.org';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/zcc.cjsView on unpkg · L2

10const SUPPORTED_PLATFORMS = [

11 {

12 key: 'darwin-arm64',

13 label: 'darwin-arm64 (macOS Apple Silicon)',

14 },

15 {

16 key: 'darwin-x64',

17 label: 'darwin-x64 (macOS Intel)',

18 },

19 {

20 key: 'linux-arm64',

21 label: 'linux-arm64',

22 },

Source & flagged code

1 flagged · loading source

bin/zcc.cjsView file

2L3: const { execFileSync } = require('child_process'); L4: const path = require('path'); L5: L6: const platform = process.platform; L7: const arch = process.arch; L8: const RELEASE_URL = 'https://github.com/tiann/zcc/releases'; L9: const OFFICIAL_NPM_REGISTRY = 'https://registry.npmjs.org'; ... L45: // Try to find the platform-specific package L46: const pkgPath = require.resolve(`${pkgName}/package.json`); L47: const binName = platformName === 'win32' ? 'zcc.exe' : 'zcc';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code