registry / @synotech/code / 0.1.5

@synotech/code@0.1.5

syCode — terminal coding agent + team daemon sidecar for remote monitoring.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 2.23 MB of source, external domains: 127.0.0.1, opencode.ai

Source & flagged code

3 flagged

dist/src/engine.jsView file

Lines 23-63javascript

23 }

24 const parent = dirname(dir);

25 if (parent === dir)

26 break;

27 dir = parent;

28 }

29 return ENGINE_BIN;

30}

31/**

32 * Ensure white-label string patches are applied to the installed tree.

33 * Runs at every boot (cheap: marker check per file) because postinstall

34 * ordering is unreliable across npm/pnpm layouts. Never throws, never

35 * fails the boot — worst case a few upstream strings show through.

36 */

37export async function ensureWhiteLabel() {

38 const here = dirname(fileURLToPath(import.meta.url));

39 for (const base of [join(here, "..", ".."), join(here, "..")]) {

40 const script = join(base, "scripts", "patch-plugins.mjs");

41 if (!existsSync(script))

42 continue;

43 try {

44 const mod = (await import(pathToFileURL(script).href));

45 if (typeof mod.ensurePatches === "function")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/engine.jsView on unpkg · L43

46 return await mod.ensurePatches();

47 return true;

48 }

49 catch {

50 return false;

51 }

52 }

53 return false;

54}

55/**

56 * Enforce the engine's `quietStartup` setting so its branded startup header

57 * (e.g. "pi v0.85.1") never prints in syCode runs. Only fills the value in

58 * when unset — an explicit user `false` is respected. Never touches anything

59 * else in the file; leaves unparseable files alone.

60 */

61export function ensureQuietStartup(agentDir = join(homedir(), ".pi", "agent")) {

62 const file = join(agentDir, "settings.json");

63 let settings = {};

dist/src/rpc.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@0.1.11 matchedPath = dist/src/rpc.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:0.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/rpc.jsView on unpkg

scripts/generate-logo.mjsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@0.1.11 matchedPath = scripts/generate-logo.mjs matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:0.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/generate-logo.mjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/src/engine.jsView file

@synotech/code@0.1.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code