registry  /  @tencent-ai/codebuddy-code  /  2.114.1

@tencent-ai/codebuddy-code@2.114.1

Use CodeBuddy, Tencent's AI assistant, right from your terminal. CodeBuddy can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 11 file(s), 2.76 MB of source, external domains: api.qrserver.com, bit.ly, cdn.jsdelivr.net, example.trycloudflare.com, github.com, json-schema.org, reactjs.org, www.w3.org
Oversized source lightweight scan
dist/codebuddy-headless.js15.5 MB file, sampled 256 KB
EnvironmentVarsObfuscatedMinified
dist/codebuddy.js20.9 MB file, sampled 256 KB
EnvironmentVarsObfuscatedMinified

Source & flagged code

7 flagged · loading source
dist/web-ui/assets/index-BE8BvufA.jsView file
897patternName = generic_password severity = medium line = 897 matchedText = daemon-s...}));
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/web-ui/assets/index-BE8BvufA.jsView on unpkg · L897
7`);s=c.pop()||"";for(const d of c){const u=d.split(` L8: `);let p="";for(const g of u)g.startsWith("data: ")&&(p+=g.substring(6));if(p)try{const g=JSON.parse(p);this.handleMessage(g)}catch{}}}}finally{n.releaseLock()}}handleMessage(t){if... L9: * @license lucide-react v1.7.0 - ISC
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/web-ui/assets/index-BE8BvufA.jsView on unpkg · L7
vendor/genie-trash/linux-arm64View file
•path = vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

vendor/genie-trash/linux-arm64View on unpkg
dist/wasm/tree-sitter.wasmView file
•path = dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter.wasmView on unpkg
vendor/shim/sitecustomize.pyView file
•path = vendor/shim/sitecustomize.py kind = build_helper sizeBytes = 25078 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/shim/sitecustomize.pyView on unpkg
dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file
•path = dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg
dist/codebuddy-headless.jsView file
•path = dist/codebuddy-headless.js kind = oversized_source_file sizeBytes = 16217992 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/codebuddy-headless.jsView on unpkg

Findings

3 High8 Medium4 Low
HighObfuscated
HighShips High Entropy Blobdist/web-ui/assets/mfixx-CpAhKOZz.woff2
HighOversized Source Filedist/codebuddy-headless.js
MediumSecret Patterndist/web-ui/assets/index-BE8BvufA.js
MediumDynamic Requiredist/web-ui/assets/index-BE8BvufA.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/genie-trash/linux-arm64
MediumShips Wasm Moduledist/wasm/tree-sitter.wasm
MediumShips Build Helpervendor/shim/sitecustomize.py
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License