registry / @thecolonylab/hivemind / 0.2.10

@thecolonylab/hivemind@0.2.10

Forager — the CLI that runs on your machine and executes for the Hivemind brain. Describe a flow in plain English, an AI agent drives a real browser and reports pass/fail. No LLM key needed on this machine.

Static Scan Results

scanned 19h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 106 KB of source, external domains: app.thecolonylab.com

Source & flagged code

3 flagged

dist/commands/init.jsView file

Lines 1-23javascript

1import { fileURLToPath } from 'node:url';

2import { dirname, join, basename } from 'node:path';

3import { mkdir, readFile, writeFile, copyFile, access } from 'node:fs/promises';

4import { execFile } from 'node:child_process';

5import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/commands/init.jsView on unpkg · L3

6import { randomBytes } from 'node:crypto';

7import { createRequire } from 'node:module';

8import { createInterface } from 'node:readline/promises';

9const execFileAsync = promisify(execFile);

10const require = createRequire(import.meta.url);

11const __dirname = dirname(fileURLToPath(import.meta.url));

12// dist/commands/init.js -> package root (skill/ ships alongside dist/, see package.json "files")

13const packageRoot = join(__dirname, '..', '..');

14async function exists(path) {

15 return access(path)

16 .then(() => true)

17 .catch(() => false);

18}

19const GENERIC_FOLDER_NAMES = new Set(['frontend', 'backend', 'client', 'server', 'app', 'src', 'web', 'api', 'ui', 'www']);

20/** A folder called "frontend" tells you nothing — most real projects that reach for a name like

21 * that are one half of a monorepo (otprelay/frontend, otprelay/backend). Prefer package.json's

22 * own name first (usually more deliberate than a folder name), then fall back to the PARENT

23 * folder when the current one is one of the generic ones, only using the plain folder name as

dist/commands/report.jsView file

Lines 1-22javascript

1import { join } from 'node:path';

2import { readFile } from 'node:fs/promises';

3import { exec } from 'node:child_process';

4import { readApiKey } from '../credentials.js';

Source & flagged code

3 flagged · loading source

dist/commands/init.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code