registry / @tencent-ai/codebuddy-code / 2.119.2

@tencent-ai/codebuddy-code@2.119.2

Use CodeBuddy, Tencent's AI assistant, right from your terminal. CodeBuddy can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 15 file(s), 1.18 MB of source, external domains: api.qrserver.com, bit.ly, github.com, reactjs.org, www.w3.org

Oversized source lightweight scan

dist/codebuddy-headless.js15.8 MB file, sampled 256 KB

EnvironmentVarsObfuscatedMinified

dist/codebuddy.js21.2 MB file, sampled 256 KB

EnvironmentVarsObfuscatedMinified

dist/web-ui/assets/index-GcU4pZms.js2.18 MB file, sampled 256 KB

NetworkObfuscatedHighEntropyStringsUrlStringsapi.qrserver.comwww.w3.org

Source & flagged code

9 flagged

vendor/shim/node-safe-delete-shim.cjsView file

Lines 1-32javascript

1/**

2 * CodeBuddy Node safe-delete shim

3 *

4 * Loaded by node-language-shim.cjs. Installs only delete-protection hooks.

5 */

7'use strict';

9const fs = require('fs');

10const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

11const os = require('os');

12const url = require('url');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

15const SESSION_ID = process.env.CODEBUDDY_SESSION_ID

16 || process.env.CLAUDE_SESSION_ID;

18if (!SESSION_ID) {

19 return;

20}

22const SAFE_DELETE_ENABLED = process.env.CODEBUDDY_SAFE_DELETE_ENABLED !== '0';

24if (!SAFE_DELETE_ENABLED) {

25 return;

26}

28if (global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__) {

29 return;

30}

31global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__ = true;

vendor/shim/broker-ipc-client.cjsView file

Lines 1-29javascript

1/**

2 * Neutral broker IPC client for vendor shims.

3 *

4 * Owns JSON-line socket transport only. Runtime-specific request semantics and

5 * response classification stay in the caller.

6 */

8'use strict';

10const net = require('net');

vendor/genie-trash/linux-arm64View file

•path = vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/genie-trash/linux-arm64View on unpkg

dist/wasm/tree-sitter.wasmView file

•path = dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter.wasmView on unpkg

vendor/shim/native/binding.gypView file

•path = vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/shim/native/binding.gypView on unpkg

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

dist/web-ui/assets/index-GcU4pZms.jsView file

•path = dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/assets/index-GcU4pZms.jsView on unpkg

Source & flagged code

9 flagged · loading source

vendor/shim/node-safe-delete-shim.cjsView file

12const url = require('url'); L13: const { execFileSync } = require('child_process'); L14:

High

Child Process

Package source references child process execution.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

8L9: const fs = require('fs'); L10: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

vendor/shim/broker-ipc-client.cjsView file

9L10: const net = require('net'); L11: const { spawnSync } = require('child_process'); L12: ... L15: function brokerTimeoutMs() { L16: const parsed = Number.parseInt(process.env.CODEBUDDY_SANDBOX_BROKER_TIMEOUT_MS || '', 10); L17: return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

vendor/shim/broker-ipc-client.cjsView on unpkg · L9

•matchType = previous_version_dangerous_delta matchedPackage = @tencent-ai/codebuddy-code@2.118.2 matchedIdentity = npm:[redacted]:2.118.2 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

vendor/shim/broker-ipc-client.cjsView on unpkg

vendor/genie-trash/linux-arm64View file

•path = vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/genie-trash/linux-arm64View on unpkg

dist/wasm/tree-sitter.wasmView file

•path = dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter.wasmView on unpkg

vendor/shim/native/binding.gypView file

•path = vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/shim/native/binding.gypView on unpkg

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

dist/web-ui/assets/index-GcU4pZms.jsView file

•path = dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/assets/index-GcU4pZms.jsView on unpkg

Findings

6 High7 Medium4 Low

HighChild Processvendor/shim/node-safe-delete-shim.cjs

HighSame File Env Network Executionvendor/shim/broker-ipc-client.cjs

HighObfuscated

HighShips High Entropy Blobdist/web-ui/assets/mfixx-CpAhKOZz.woff2

HighOversized Source Filedist/web-ui/assets/index-GcU4pZms.js

HighPrevious Version Dangerous Deltavendor/shim/broker-ipc-client.cjs

MediumDynamic Requirevendor/shim/node-safe-delete-shim.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/genie-trash/linux-arm64

MediumShips Wasm Moduledist/wasm/tree-sitter.wasm

MediumShips Build Helpervendor/shim/native/binding.gyp

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

vendor/shim/node-safe-delete-shim.cjsView file

Lines 1-32javascript

1/**

2 * CodeBuddy Node safe-delete shim

3 *

4 * Loaded by node-language-shim.cjs. Installs only delete-protection hooks.

5 */

7'use strict';

9const fs = require('fs');

10const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

11const os = require('os');

12const url = require('url');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

15const SESSION_ID = process.env.CODEBUDDY_SESSION_ID

16 || process.env.CLAUDE_SESSION_ID;

18if (!SESSION_ID) {

19 return;

20}

22const SAFE_DELETE_ENABLED = process.env.CODEBUDDY_SAFE_DELETE_ENABLED !== '0';

24if (!SAFE_DELETE_ENABLED) {

25 return;

26}

28if (global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__) {

29 return;

30}

31global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__ = true;

vendor/shim/broker-ipc-client.cjsView file

Lines 1-29javascript

1/**

2 * Neutral broker IPC client for vendor shims.

3 *

4 * Owns JSON-line socket transport only. Runtime-specific request semantics and

5 * response classification stay in the caller.

6 */

8'use strict';

10const net = require('net');

vendor/genie-trash/linux-arm64View file

•path = vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/genie-trash/linux-arm64View on unpkg

dist/wasm/tree-sitter.wasmView file

•path = dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter.wasmView on unpkg

vendor/shim/native/binding.gypView file

•path = vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/shim/native/binding.gypView on unpkg

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

dist/web-ui/assets/index-GcU4pZms.jsView file

•path = dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web-ui/assets/index-GcU4pZms.jsView on unpkg