registry  /  @staff0rd/assist  /  0.344.1

@staff0rd/assist@0.344.1

⚠ Under review

A CLI tool for enforcing determinism in LLM development workflow automation.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 8 file(s), 1.87 MB of source, external domains: 127.0.0.1, amazon-useast-1-oauth.ravenhq.com, app.netlify.com, cli.github.com, github.com, host.ravenhq.com, id.atlassian.com, kroki.io, react.dev, ro.am, unpkg.com, www.linkedin.com, www.w3.org

Source & flagged code

7 flagged · loading source
dist/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @staff0rd/assist@0.341.1 matchedIdentity = npm:QHN0YWZmMHJkL2Fzc2lzdA:0.341.1 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg
114// src/commands/commit.ts L115: import { execSync as execSync2 } from "child_process"; L116:
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L114
2288stdio: shouldSuppress(quiet) ? "pipe" : "inherit", L2289: shell: true, L2290: cwd: cwd ?? process.cwd(),
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2288
5Cross-file remote execution chain: dist/index.js spawns [redacted].js; helper contains network access plus dynamic code execution. L5: L6: // package.json L7: var package_default = { ... L42: type: "git", L43: url: "https://github.com/staff0rd/assist" L44: }, ... L114: // src/commands/commit.ts L115: import { execSync as execSync2 } from "child_process"; L116: ... L344: function getConfigPath() { L345: const found = findConfigUp(process.cwd()); L346: if (found) return found.configPath;
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L5
5L6: // package.json L7: var package_default = { ... L42: type: "git", L43: url: "https://github.com/staff0rd/assist" L44: }, ... L114: // src/commands/commit.ts L115: import { execSync as execSync2 } from "child_process"; L116: ... L344: function getConfigPath() { L345: const found = findConfigUp(process.cwd()); L346: if (found) return found.configPath;
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L5
dist/commands/deploy/init/index.tsView file
8try { L9: execSync("netlify sites:create --disable-linking", { stdio: "inherit" }); L10: } catch (error) { ... L21: chalk.yellow( L22: "\nInstall it manually with: npm install -g netlify-cli\n", L23: ),
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/deploy/init/index.tsView on unpkg · L8
dist/commands/voice/python/wake_word.pyView file
•path = dist/commands/voice/python/wake_word.py kind = build_helper sizeBytes = 759 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/commands/voice/python/wake_word.pyView on unpkg

Findings

1 Critical4 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighCross File Remote Execution Contextdist/index.js
HighRuntime Package Installdist/commands/deploy/init/index.ts
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdist/commands/voice/python/wake_word.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings