registry / @t2code/cli
@t2code/cli
⚠ Under reviewT2 Code CLI. Downloads the self-contained executable for this platform from the GitHub Release.
This report shows the evidence for @t2code/cli@0.1.1. 0 of 2 known versions are blocked or flagged. See all versions.
Static Scan Results
scanned 18d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
4 flaggedbin/t2code.mjsView file
7// it over an IPC channel.
L8: import { spawn, spawnSync } from "node:child_process";
L9: import crypto from "node:crypto";
High
7Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network
L7: // it over an IPC channel.
L8: import { spawn, spawnSync } from "node:child_process";
L9: import crypto from "node:crypto";
...
L13:
L14: const { version } = JSON.parse(
L15: fs.readFileSync(path.join(import.meta.dirname, "../package.json"), "utf8"),
L16: );
...
L20: function t2Home() {
L21: const raw = (process.env.T2CODE_HOME || "").trim();
L22: if (raw === "") return path.join(os.homedir(), ".t2");
L23: if (raw === "~") return os.homedir();
...
L28: async function get(url) {
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/t2code.mjsView on unpkg · L7bin/t2code.mjs#virtual:normalized:round1View file
Findings
4 High3 Medium2 Low
HighChild Processbin/t2code.mjs
HighEntrypoint Build Divergencebin/t2code.mjs
HighSame File Env Network Executionbin/t2code.mjs#virtual:normalized:round1
HighSemantic Analysis Limitedbin/t2code.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @t2code/cli@0.1.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @t2code/cli@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.