registry / @thegitai/cli / 1.0.0-preview.2

@thegitai/cli@1.0.0-preview.2

TheGitAI CLI client (source-visible, proprietary)

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 99 file(s), 786 KB of source, external domains: 127.0.0.1, thegit.ai

Source & flagged code

4 flagged

dist/vendor/web-tree-sitter/web-tree-sitter.cjsView file

Lines 1-28javascript

1"use strict";

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

9var __commonJS = (cb, mod) => function __require() {

10 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vendor/web-tree-sitter/web-tree-sitter.cjsView on unpkg · L8

11};

12var __export = (target, all) => {

13 for (var name2 in all)

14 __defProp(target, name2, { get: all[name2], enumerable: true });

15};

16var __copyProps = (to, from, except, desc) => {

17 if (from && typeof from === "object" || typeof from === "function") {

18 for (let key of __getOwnPropNames(from))

19 if (!__hasOwnProp.call(to, key) && key !== except)

20 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

21 }

22 return to;

23};

24var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

25 // If the importer is in node compatibility mode or this is not an ESM

26 // file that has been converted to a CommonJS file using a Babel-

27 // compatible transform (i.e. "__esModule" has not been set), then set

28 // "default" to the CommonJS "module.exports" for node compatibility.

Lines 837-877javascript

837 "env": proxy,

838 "wasi_snapshot_preview1": proxy

839 };

840 function postInstantiation(module, instance) {

841 updateTableMap(tableBase, metadata.tableSize);

842 moduleExports = relocateExports

dist/parsers/tree-sitter-go.wasmView file

•path = dist/parsers/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/parsers/tree-sitter-go.wasmView on unpkg

dist/src/tools/run-node-script.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @thegitai/cli@1.0.0-beta.19 matchedIdentity = npm:QHRoZWdpdGFpL2NsaQ:1.0.0-beta.19 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/tools/run-node-script.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/vendor/web-tree-sitter/web-tree-sitter.cjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code