registry / @tryglen/cli / 0.17.0

@tryglen/cli@0.17.0

Glen CLI — memory for coding agents

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 251 KB of source, external domains: 127.0.0.1, app.tryglen.com, cursor.com, docs.npmjs.com, fonts.googleapis.com, fonts.gstatic.com, github.com, nodejs.org, registry.npmjs.org, tryglen.com

Source & flagged code

3 flagged

dist/_utils/parse-cursor-db.jsView file

Lines 1-29javascript

1import { existsSync } from "node:fs";

2import { copyFile, mkdtemp, open, rm } from "node:fs/promises";

3import { tmpdir } from "node:os";

4import { basename, join } from "node:path";

5import { causeOf, cliErr } from "./cli-error.js";

6import { err, ok } from "./result.js";

7const loadSqlite = async () => {

8 try {

9 // Indirect specifier: @types/node@20 (the floor we compile against) has no

10 // node:sqlite declarations, so a literal import() would fail tsc even

11 // though the module exists at runtime on Node >= 22.5.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_utils/parse-cursor-db.jsView on unpkg · L9

12 const specifier = "node:sqlite";

13 const sqlite = (await import(specifier));

14 return sqlite.DatabaseSync ?? null;

15 }

16 catch {

17 return null;

18 }

19};

20const parseJson = (value) => {

21 if (typeof value !== "string")

22 return null;

23 try {

24 const parsed = JSON.parse(value);

25 return parsed !== null && typeof parsed === "object"

26 ? parsed

27 : null;

28 }

29 catch {

dist/_utils/update.jsView file

Lines 1-21javascript

1import { execFileSync, spawn, spawnSync } from "node:child_process";

2import { mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs";

3import { homedir } from "node:os";

4import { dirname, join } from "node:path";

5import { runBin } from "./run-bin.js";

dist/commands/code-search.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tryglen/cli@0.13.0 matchedIdentity = npm:QHRyeWdsZW4vY2xp:0.13.0 similarity = 0.839 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/code-search.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/_utils/parse-cursor-db.jsView file

9// Indirect specifier: @types/node@20 (the floor we compile against) has no L10: // node:sqlite declarations, so a literal import() would fail tsc even L11: // though the module exists at runtime on Node >= 22.5.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_utils/parse-cursor-db.jsView on unpkg · L9

dist/_utils/update.jsView file

1import { execFileSync, spawn, spawnSync } from "node:child_process"; L2: import { mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs"; ... L8: // when GLEN_STATE_PATH is set (tests), the glen dir is its dirname. L9: const glenDir = () => process.env.GLEN_STATE_PATH L10: ? dirname(process.env.GLEN_STATE_PATH) L11: : join(homedir(), ".glen"); L12: const checkPath = () => join(glenDir(), "update-check.json"); ... L15: const autoUpdateDisabled = () => process.env.GLEN_NO_AUTO_UPDATE === "1" || L16: process.env.CI === "true" || L17: process.env.CI === "1"; ... L21: try { L22: const data = JSON.parse(readFileSync(checkPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/_utils/update.jsView on unpkg · L1

dist/commands/code-search.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/code-search.jsView on unpkg

Findings

2 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/_utils/update.js

HighPrevious Version Dangerous Deltadist/commands/code-search.js

MediumDynamic Requiredist/_utils/parse-cursor-db.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/_utils/parse-cursor-db.jsView file

Lines 1-29javascript

1import { existsSync } from "node:fs";

2import { copyFile, mkdtemp, open, rm } from "node:fs/promises";

3import { tmpdir } from "node:os";

4import { basename, join } from "node:path";

5import { causeOf, cliErr } from "./cli-error.js";

6import { err, ok } from "./result.js";

7const loadSqlite = async () => {

8 try {

9 // Indirect specifier: @types/node@20 (the floor we compile against) has no

10 // node:sqlite declarations, so a literal import() would fail tsc even

11 // though the module exists at runtime on Node >= 22.5.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/_utils/parse-cursor-db.jsView on unpkg · L9

12 const specifier = "node:sqlite";

13 const sqlite = (await import(specifier));

14 return sqlite.DatabaseSync ?? null;

15 }

16 catch {

17 return null;

18 }

19};

20const parseJson = (value) => {

21 if (typeof value !== "string")

22 return null;

23 try {

24 const parsed = JSON.parse(value);

25 return parsed !== null && typeof parsed === "object"

26 ? parsed

27 : null;

28 }

29 catch {

dist/_utils/update.jsView file

Lines 1-21javascript

1import { execFileSync, spawn, spawnSync } from "node:child_process";

2import { mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs";

3import { homedir } from "node:os";

4import { dirname, join } from "node:path";

5import { runBin } from "./run-bin.js";

dist/commands/code-search.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/code-search.jsView on unpkg