registry / @tradeinsight-info/ti / 0.2.0

@tradeinsight-info/ti@0.2.0

TradeInsight's finance & trading CLI agent for quants and traders — research the market, backtest strategies, and optimise portfolios in plain language.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 201 file(s), 2.51 MB of source, external domains: accounts.google.com, api.exa.ai, api.github.com, api.openai.com, api.parallel.ai, api.perplexity.ai, api.search.brave.com, api.tavily.com, api.tradeinsight.info, app.tavily.com, app.tradeinsight.info, auth.tradeinsight.info, brave.com, cdn.jsdelivr.net, chatgpt.com, claude.ai, cli.github.com, content-push.googleapis.com, fonts.googleapis.com, fonts.gstatic.com, gemini.google.com, generativelanguage.googleapis.com, git-scm.com, github.com, img.youtube.com, mariozechner.at, mcp.exa.ai, mistral.ai, perplexity.ai, pi.dev, platform.parallel.ai, r.jina.ai, tradeinsight.info, www.bitcoin.org, www.google.com, www.youtube.com

Source & flagged code

5 flagged

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Lock the release artifact's FULL transitive dependency tree.

3//

4// build-dist writes exact versions for the manifest's direct deps, but that alone

5// doesn't freeze deps-of-deps (e.g. pi's @earendil-works/* sub-packages reference

6// each other with caret ranges). npm honors a package's npm-shrinkwrap.json when

7// the package is installed AS A DEPENDENCY (unlike package-lock.json), so shipping

8// one freezes the entire closure deterministically. This mirrors upstream pi, which

9// ships a npm-shrinkwrap.json generated at prepublish.

10//

11// npm always packs npm-shrinkwrap.json into the tarball regardless of `files`, so

12// generating it here (before `npm pack` in smoke:dist / the release) is enough.

13import { execFileSync } from "node:child_process";

14import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

packages/ti-distribution/scripts/shrinkwrap-dist.mjsView on unpkg · L12

15import { join } from "node:path";

16import { fileURLToPath } from "node:url";

18const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));

19const STAGE = join(REPO_ROOT, "dist-pkg");

20const NPM = process.platform === "win32" ? "npm.cmd" : "npm";

22if (!existsSync(join(STAGE, "package.json"))) {

23 console.error("[shrinkwrap-dist] dist-pkg/ not built — run build-dist first");

24 process.exit(1);

25}

27const run = (args) => execFileSync(NPM, args, { cwd: STAGE, stdio: "inherit" });

29// Resolve the full tree into package-lock.json without installing node_modules,

30// then convert it to npm-shrinkwrap.json (the dependency-honored lockfile).

31console.log("[shrinkwrap-dist] resolving full dependency tree");

32run(["install", "--package-lock-only", "--no-audit", "--no-fund"]);

packages/ti-distribution/vendor/pi/dist/utils/tools-manager.jsView file

Lines 166-206javascript

166}

167function getWindowsTarCommand() {

168 const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;

169 if (systemRoot) {

170

packages/ti-distribution/bin/ti.mjsView file

Lines 45-67javascript

45// Inject the hardcoded extension bundle (see bundle.mjs) with --no-extensions to

46// prevent settings/package-based extensions from loading. Only our entries load.

47//

48// Entry resolution: default to raw TS (dev, no build step). Set TI_DIST=1 to load

49// the built dist/index.js bundles (produced by `bun run build`) — used for

50// packaged delivery so we ship compiled JS instead of source.

51const finalArgs = buildBundleArgs(filtered, process.env.TI_DIST

packages/ti-distribution/vendor/pi/dist/modes/interactive/interactive-mode.jsView file

Lines 1-31javascript

1/**

2 * Interactive mode for the coding agent.

3 * Handles TUI rendering and user interaction, delegating business logic to AgentSession.

4 */

5import * as crypto from "node:crypto";

6import *

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView file

•path = packages/ti-[redacted]-vs-growth.backtest.py kind = build_helper sizeBytes = 1795 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/ti-finance/knowledge/strategies/value-vs-growth.backtest.pyView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code