registry / @swirls/cli / 0.1.114

@swirls/cli@0.1.114

⚠ Under review

Swirls command line application

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 1.35 KB of source, external domains: swirls.ai

Source & flagged code

9 flagged

package.jsonView file

Lines 1-41json

2 "name": "@swirls/cli",

3 "version": "0.1.114",

4 "description": "Swirls command line application",

5 "author": {

6 "name": "Swirls",

7 "url": "https://swirls.ai"

8 },

9 "type": "module",

10 "bin": {

11 "swirls": "./bin/swirls"

12 },

13 "files": [

14 "bin",

15 "scripts/install.js"

16 ],

17 "scripts": {

18 "build": "bun run scripts/build.ts",

19 "depcruise": "bun ../../.github/scripts/depcruise-workspace.mjs",

20 "dev": "bun run --watch src/bin/cli.ts",

21 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "bun test",

23 "test:coverage": "bun test --coverage --coverage-reporter=lcov --coverage-reporter=text",

24 "version": "bun run scripts/version.ts"

25 },

26 "devDependencies": {

27 "@byteslice/result": "0.3.0",

28 "@clack/prompts": "1.0.0",

29 "@elysiajs/eden": "1.4.8",

30 "@orpc/client": "1.13.14",

31 "@orpc/contract": "1.13.14",

32 "@stricli/core": "1.2.4",

33 "@swirls/agent": "0.0.1",

34 "@swirls/auth": "0.1.0",

35 "@swirls/contract": "0.0.1",

36 "@swirls/deploy": "0.0.1",

37 "@swirls/execution-events": "0.0.1",

38 "@swirls/language": "0.0.90",

39 "@swirls/registry": "0.0.1",

40 "@swirls/schemas": "0.0.1",

41 "@swirls/sdk": "1.1.5",

scripts/install.jsView file

Lines 1-60javascript

1#!/usr/bin/env node

3/**

4 * Runs the install script for platform detection and binary

5 * download, then copies the binary into bin/ so `swirls` runs the real

6 * binary (no Node wrapper).

7 *

8 * Skips installation in the following cases:

9 * - CI environment

10 * - Not installed globally

11 * - Windows (no curl/bash)

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code