registry / @stravica-ai/digital-operator-pa / 0.1.2

@stravica-ai/digital-operator-pa@0.1.2

Digital Operator PA — single-bundled public package surface (bins + library) for the platform.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 169 file(s), 1.23 MB of source, external domains: 1.1.1.1, 127.0.0.1, api.cloudflare.com, cli.github.com, github.com, status.anthropic.com, www.apple.com, www.githubstatus.com, www.googleapis.com

Source & flagged code

6 flagged

dist/engineering-pa-scaffold/src/runner.mjsView file

Lines 1-31javascript

1// runner.mjs — chokepoint for external effects.

2//

3// All filesystem writes for the scaffolder happen here. All process spawns

4// (pnpm install, pa status, git init) happen here. Nothing else in the

5// scaffolder reaches the disk or the OS.

6//

7// Tests inject a `{ spawn }` seam to verify framing without executing

8// real subprocesses. The filesystem writes are exercised against a real

9// tmp dir in the end-to-end test.

11import { mkdir, readdir, stat, writeFile } from 'node:fs/promises';

12import { spawn as realSpawn } from 'node:child_process';

13import { dirname, join } from 'node:path';

High

Child Process

Package source references child process execution.

dist/engineering-pa-scaffold/src/runner.mjsView on unpkg · L11

15/**

16 * Pre-flight: verify the target dir is either missing or empty. Throws

17 * with exitCode=1 on a clobber risk.

18 */

19export async function assertTargetIsEmptyOrMissing(targetDir) {

20 let entries;

21 try {

22 entries = await readdir(targetDir);

23 } catch (err) {

24 if (err.code === 'ENOENT') return; // OK: we'll create it.

25 throw err;

26 }

27 const visible = entries.filter((name) => !name.startsWith('.DS_Store'));

28 if (visible.length > 0) {

29 const e = new Error(

30 `target directory is not empty: ${targetDir} (contains ${visible.length} entries)`,

31 );

dist/engineering-pa-cli/src/launch/runner.mjsView file

Lines 31-71javascript

31function resolveWorkdir(workdir, repoRoot) {

32 if (!workdir) return repoRoot;

33 return workdir

34 .replace(/\$\{DAVE_ROOT\}/g, repoRoot)

35 .replace

dist/engineering-pa-cli/src/environment/cli.mjsView file

Lines 138-178javascript

138 }

139 }

140 return networkDegraded ? 3 : 0;

141}

142

143async function runExtended(flags, extraArgs) {

144 const

dist/engineering-pa-core/src/scheduler/install.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * install.mjs -- Install a Dave schedule definition using the specified backend

4 *

5 * Usage: node node_modules/@stravica-ai/engineering-pa-core/src/scheduler/install.mjs <schedule.json> <backend>

6 *

7 * Reads a schedule JSON file and installs it using the specified backend

8 * (cron, launchd, systemd, schtasks). The schedule field uses cron syntax

9 * (minute hour day month weekday). This script translates to the native

10 * format for each backend.

dist/engineering-pa-workspace/src/api.mjsView file

Lines 1-22javascript

1import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, statSync } from 'node:fs';

2import { join, resolve, relative } from 'node:path';

3import { execSync, execFile } from 'node:child_process';

4import { promisify } from 'node:util';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/engineering-pa-workspace/src/api.mjs

dist/engineering-pa-workspace/src/install-daemon.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * install-daemon.mjs — Install the workspace server as a supervised daemon

5 *

6 * Supervises the workspace server via the host's native service manager so it

7 * auto-starts at login and auto-restarts on crash. This is distinct from the

8 * scheduler tool (cron/launchd-calendar/systemd-timer/schtasks), which is

9 * time-triggered. A daemon is continuous-supervision and needs KeepAlive /

10 * Restart=always / RunAtLoad semantics that cron doesn't express.

11 *

Source & flagged code

6 flagged · loading source

dist/engineering-pa-scaffold/src/runner.mjsView file

11import { mkdir, readdir, stat, writeFile } from 'node:fs/promises'; L12: import { spawn as realSpawn } from 'node:child_process'; L13: import { dirname, join } from 'node:path';

High

Child Process

Package source references child process execution.

dist/engineering-pa-scaffold/src/runner.mjsView on unpkg · L11

dist/engineering-pa-cli/src/launch/runner.mjsView file

51* Why reject instead of parse: silently splitting a quoted command on L52: * whitespace shreds it ("bash -c \"a && b\"" → spawn('bash', L53: * ['-c', '"a', '&&', 'b"']) — bash exits 2, cron mails operator forever).

High

Shell

Package source references shell execution.

dist/engineering-pa-cli/src/launch/runner.mjsView on unpkg · L51

dist/engineering-pa-cli/src/environment/cli.mjsView file

158try { L159: mod = await import(pathToFileURL(extensionPath).href); L160: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/engineering-pa-cli/src/environment/cli.mjsView on unpkg · L158

dist/engineering-pa-core/src/scheduler/install.mjsView file

7* Reads a schedule JSON file and installs it using the specified backend L8: * (cron, launchd, systemd, schtasks). The schedule field uses cron syntax L9: * (minute hour day month weekday). This script translates to the native ... L18: import { homedir, hostname } from 'node:os'; L19: import { execSync } from 'node:child_process'; L20: import { fileURLToPath } from 'node:url'; ... L24: const __filename = fileURLToPath(import.meta.url); L25: const __dirname = dirname(__filename); L26: ... L78: const raw = readFileSync(filePath, 'utf8'); L79: return JSON.parse(raw); L80: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/engineering-pa-core/src/scheduler/install.mjsView on unpkg · L7

dist/engineering-pa-workspace/src/api.mjsView file

2import { join, resolve, relative } from 'node:path'; L3: import { execSync, execFile } from 'node:child_process'; L4: import { promisify } from 'node:util'; ... L49: try { L50: const body = JSON.parse(raw); L51: const result = processOnboarding(body, repoRoot); ... L311: let host = null; L312: try { host = hostname(); } catch { /* non-fatal */ } L313: sendJson(res, 200, { schedules, liveStatus, backend, schedulerError, agenda, hostname: host }); ... L337: } catch { L338: sendJson(res, 200, { available: false, reason: 'gh CLI not installed. Install it from https://cli.github.com/ to enable repository features.' }); L339: return true;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/engineering-pa-workspace/src/api.mjsView on unpkg · L2

dist/engineering-pa-workspace/src/install-daemon.mjsView file

7Cross-file remote execution chain: dist/engineering-pa-workspace/src/install-daemon.mjs spawns dist/engineering-pa-workspace/src/server.mjs; helper contains network access plus dynamic code execution. L7: * auto-starts at login and auto-restarts on crash. This is distinct from the L8: * scheduler tool (cron/launchd-calendar/systemd-timer/schtasks), which is L9: * time-triggered. A daemon is continuous-supervision and needs KeepAlive / ... L21: * L22: * Exit codes: L23: * 0 — OK ... L28: L29: import { execSync } from 'node:child_process'; L30: import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync, realpathSync } from 'node:fs'; ... L35: const __filename = fileURLToPath(import.meta.url); L36: const __dirname = dirname(__filename); L37:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/engineering-pa-workspace/src/install-daemon.mjsView on unpkg · L7

Findings

4 High5 Medium5 Low

HighChild Processdist/engineering-pa-scaffold/src/runner.mjs

HighShelldist/engineering-pa-cli/src/launch/runner.mjs

HighSandbox Evasion Gated Capabilitydist/engineering-pa-workspace/src/api.mjs

HighCross File Remote Execution Contextdist/engineering-pa-workspace/src/install-daemon.mjs

MediumDynamic Requiredist/engineering-pa-cli/src/environment/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/engineering-pa-core/src/scheduler/install.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/engineering-pa-scaffold/src/runner.mjsView file

Lines 1-31javascript

1// runner.mjs — chokepoint for external effects.

2//

3// All filesystem writes for the scaffolder happen here. All process spawns

4// (pnpm install, pa status, git init) happen here. Nothing else in the

5// scaffolder reaches the disk or the OS.

6//

7// Tests inject a `{ spawn }` seam to verify framing without executing

8// real subprocesses. The filesystem writes are exercised against a real

9// tmp dir in the end-to-end test.

11import { mkdir, readdir, stat, writeFile } from 'node:fs/promises';

12import { spawn as realSpawn } from 'node:child_process';

13import { dirname, join } from 'node:path';

High

Child Process

Package source references child process execution.

dist/engineering-pa-scaffold/src/runner.mjsView on unpkg · L11

15/**

16 * Pre-flight: verify the target dir is either missing or empty. Throws

17 * with exitCode=1 on a clobber risk.

18 */

19export async function assertTargetIsEmptyOrMissing(targetDir) {

20 let entries;

21 try {

22 entries = await readdir(targetDir);

23 } catch (err) {

24 if (err.code === 'ENOENT') return; // OK: we'll create it.

25 throw err;

26 }

27 const visible = entries.filter((name) => !name.startsWith('.DS_Store'));

28 if (visible.length > 0) {

29 const e = new Error(

30 `target directory is not empty: ${targetDir} (contains ${visible.length} entries)`,

31 );

dist/engineering-pa-cli/src/launch/runner.mjsView file

Lines 31-71javascript

31function resolveWorkdir(workdir, repoRoot) {

32 if (!workdir) return repoRoot;

33 return workdir

34 .replace(/\$\{DAVE_ROOT\}/g, repoRoot)

35 .replace

dist/engineering-pa-cli/src/environment/cli.mjsView file

Lines 138-178javascript

138 }

139 }

140 return networkDegraded ? 3 : 0;

141}

142

143async function runExtended(flags, extraArgs) {

144 const

dist/engineering-pa-core/src/scheduler/install.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * install.mjs -- Install a Dave schedule definition using the specified backend

4 *

5 * Usage: node node_modules/@stravica-ai/engineering-pa-core/src/scheduler/install.mjs <schedule.json> <backend>

6 *

7 * Reads a schedule JSON file and installs it using the specified backend

8 * (cron, launchd, systemd, schtasks). The schedule field uses cron syntax

9 * (minute hour day month weekday). This script translates to the native

10 * format for each backend.

dist/engineering-pa-workspace/src/api.mjsView file

Lines 1-22javascript

1import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, statSync } from 'node:fs';

2import { join, resolve, relative } from 'node:path';

3import { execSync, execFile } from 'node:child_process';

4import { promisify } from 'node:util';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/engineering-pa-workspace/src/api.mjs

dist/engineering-pa-workspace/src/install-daemon.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * install-daemon.mjs — Install the workspace server as a supervised daemon

5 *

6 * Supervises the workspace server via the host's native service manager so it

7 * auto-starts at login and auto-restarts on crash. This is distinct from the

8 * scheduler tool (cron/launchd-calendar/systemd-timer/schtasks), which is

9 * time-triggered. A daemon is continuous-supervision and needs KeepAlive /

10 * Restart=always / RunAtLoad semantics that cron doesn't express.

11 *