Static Scan Results
scanned 2d ago · by rust-scannerStatic analysis flagged 23 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/init/statusline-generator.jsView file
85const path = require('path');
L86: const { execSync } = require('child_process');
L87: const os = require('os');
High
Child Process
Package source references child process execution.
dist/src/init/statusline-generator.jsView on unpkg · L85222? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null'
L223: : 'npx --prefer-offline @swarmdo/cli hooks statusline --json 2>/dev/null';
L224: const raw = execSync(
L225: cmd,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/src/init/statusline-generator.jsView on unpkg · L22218* install with custom prefix, pnpm content-addressable layout, etc.). Walks up
L19: * from this module's location until it finds a package.json whose name is
L20: * `@swarmdo/cli`. Works in both the src tree (under tsx) and the compiled dist
...
L32: try {
L33: const pkg = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
L34: if (pkg.name === '@swarmdo/cli' && typeof pkg.version === 'string' && pkg.version.length > 0) {
...
L85: const path = require('path');
L86: const { execSync } = require('child_process');
L87: const os = require('os');
...
L98: // SWARMDO_STATUSLINE_HIDE_COST 1/true/yes/on removes the segment entirely.
L99: costSymbol: process.env.SWARMDO_STATUSLINE_COST_SYMBOL ?? '$',
L100: hideCost: /^(1|true|yes|on)$/i.test(process.env.SWARMDO_STATUSLINE_HIDE_COST || ''),
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/src/init/statusline-generator.jsView on unpkg · L18dist/src/init/executor.jsView file
254// Platform-specific command wrappers
L255: // Windows: Use PowerShell-compatible commands
L256: // Mac/Linux: Use bash-compatible commands with 2>/dev/null
High
272// Uses node -e with git rev-parse so hooks work regardless of CWD (#1259, #1284).
L273: const gitRootResolver = "var c=require('child_process'),p=require('path'),u=require('url'),r;"
L274: + "try{r=c.execSync('git rev-parse --show-toplevel',{encoding:'utf8'}).trim()}"
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/init/executor.jsView on unpkg · L272dist/src/commands/security.jsView file
143const codePatterns = [
L144: { pattern: /eval\s*\(/g, type: 'Eval Usage', severity: 'medium', desc: 'eval() can execute arbitrary code' },
L145: { pattern: /innerHTML\s*=/g, type: 'innerHTML', severity: 'medium', desc: 'XSS risk with innerHTML' },
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/src/commands/security.jsView on unpkg · L143dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View file
49// 1. Environment variable (fastest path, used in test mocks and CI)
L50: const envKey = process.env['GOOGLE_AI_API_KEY'];
L51: if (envKey)
...
L54: try {
L55: const { execSync } = await import('node:child_process');
L56: const key = execSync('gcloud secrets versions access latest --secret=GOOGLE_AI_API_KEY --project=swarm-dev 2>/dev/null', { encoding: 'utf-8', timeout: 5_000 }).trim();
...
L62: }
L63: throw new Error("grounded_query: No Google AI API key found.\nSet GOOGLE_AI_API_KEY env var, or ensure `gcloud` is authenticated and\nthe secret GOOGLE_AI_API_KEY exists in GCP pro...
L64: }
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View on unpkg · L49dist/src/memory/neural-package-bridge.jsView file
38package = @swarmdo/cli; repositoryIdentity = swarmdo; dependency = @swarmdo/neural
L38: try {
L39: const m = await import('@swarmdo/neural');
L40: const sys = m.createNeuralLearningSystem(mode);
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/src/memory/neural-package-bridge.jsView on unpkg · L38vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView file
•path = vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm
kind = wasm_module
sizeBytes = 71343
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView on unpkgplugins/swarmdo-metaharness/scripts/smoke.shView file
•path = plugins/swarmdo-metaharness/scripts/smoke.sh
kind = build_helper
sizeBytes = 124488
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
plugins/swarmdo-metaharness/scripts/smoke.shView on unpkg.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView file
•path = .claude/skills/sdo-caveman-compress/scripts/benchmark.py
kind = payload_in_excluded_dir
sizeBytes = 2433
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView on unpkg.claude/agents/sparc/refinement.mdView file
339patternName = generic_password
severity = medium
line = 339
matchedText = password...23!'
Medium
Secret Pattern
Hardcoded password in .claude/agents/sparc/refinement.md
.claude/agents/sparc/refinement.mdView on unpkg · L339367patternName = generic_password
severity = medium
line = 367
matchedText = password...ord'
Medium
Secret Pattern
Hardcoded password in .claude/agents/sparc/refinement.md
.claude/agents/sparc/refinement.mdView on unpkg · L367543patternName = generic_password
severity = medium
line = 543
matchedText = passwo...
Medium
Secret Pattern
Hardcoded password in .claude/agents/sparc/refinement.md
.claude/agents/sparc/refinement.mdView on unpkg · L543Findings
7 High11 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/init/statusline-generator.js
HighShelldist/src/init/executor.js
HighSame File Env Network Executiondist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1
HighCopied Package Dependency Bridgedist/src/memory/neural-package-bridge.js
HighRuntime Package Installdist/src/init/statusline-generator.js
HighPayload In Excluded Dir.claude/skills/sdo-caveman-compress/scripts/benchmark.py
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/src/init/executor.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/src/init/statusline-generator.js
MediumShips Wasm Modulevendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm
MediumShips Build Helperplugins/swarmdo-metaharness/scripts/smoke.sh
MediumStructural Risk Force Deep Review
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
LowScripts Present
LowEvaldist/src/commands/security.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings