registry  /  @tryglen/cli  /  0.13.0

@tryglen/cli@0.13.0

Glen CLI — memory for coding agents

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 62 file(s), 193 KB of source, external domains: 127.0.0.1, app.tryglen.com, docs.npmjs.com, fonts.googleapis.com, fonts.gstatic.com, nodejs.org, registry.npmjs.org, tryglen.com

Source & flagged code

1 flagged · loading source
dist/_utils/update.jsView file
1import { execFileSync, spawn, spawnSync } from "node:child_process"; L2: import { mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs"; ... L8: // when GLEN_STATE_PATH is set (tests), the glen dir is its dirname. L9: const glenDir = () => process.env.GLEN_STATE_PATH L10: ? dirname(process.env.GLEN_STATE_PATH) L11: : join(homedir(), ".glen"); L12: const checkPath = () => join(glenDir(), "update-check.json"); ... L15: const autoUpdateDisabled = () => process.env.GLEN_NO_AUTO_UPDATE === "1" || L16: process.env.CI === "true" || L17: process.env.CI === "1"; ... L21: try { L22: const data = JSON.parse(readFileSync(checkPath(), "utf8"));
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/_utils/update.jsView on unpkg · L1

Findings

1 High3 Medium4 Low
HighSandbox Evasion Gated Capabilitydist/_utils/update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings