@twing/cli@0.2.27

⚠ Under review

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 308 KB of source, external domains: coordination-server.twing.dev, github.com

Source & flagged code

4 flagged

dist/spawn-daemon.jsView file

Lines 1-29javascript

1/**

2 * Starts the daemon (§6 step 4), and writes the launch marker

3 * `daemon-service.ts`'s `installDaemonService` (persistent OS-level

4 * service, "the primary path" per the design doc §5) and the Go hook's

5 * self-heal (`hook/daemon_launch.go`) both depend on -- so every path that

6 * can bring the daemon up agrees on how. This function itself is the

7 * doc's documented fallback: "a detached background process otherwise,"

8 * for machines/platforms with no service installed.

9 */

10import { spawn } from "node:child_process";

11import * as net from "node:net";

High

Child Process

Package source references child process execution.

dist/spawn-daemon.jsView on unpkg · L9

12import { defaultSocketPath } from "@twing/core";

13import { resolveDaemonScript, writeDaemonLaunchMarker } from "./daemon-service.js";

14function isDaemonRunning(socketPath) {

15 return new Promise((resolve) => {

16 const probe = net.createConnection(socketPath);

17 probe.once("connect", () => {

18 probe.end();

19 resolve(true);

20 });

21 probe.once("error", () => resolve(false));

22 });

23}

24/** No-ops if a daemon is already listening on the socket -- re-running

25 * `twing init` in a second repo reuses it rather than spawning a duplicate.

26 * Always (re)writes the launch marker first, even on the already-running

27 * path -- keeps it current with this build's paths regardless of whether a

28 * fresh spawn happens here.

29 *

dist/test-support.jsView file

Lines 14-54javascript

14import * as fs from "node:fs";

15import * as os from "node:os";

16import * as path from

dist/design.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/design.js#virtual:normalized:round1View on unpkg

dist/design.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @twing/cli@0.2.26 matchedIdentity = npm:QHR3aW5nL2NsaQ:0.2.26 similarity = 0.946 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/design.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/spawn-daemon.jsView file

9*/ L10: import { spawn } from "node:child_process"; L11: import * as net from "node:net";

High

Child Process

Package source references child process execution.

dist/spawn-daemon.jsView on unpkg · L9

dist/test-support.jsView file

34export function addGithubRemote(repo, owner, name) { L35: execFileSync("git", ["remote", "add", "origin", `https://github.com/${owner}/${name}.git`], { cwd: repo }); L36: } ... L49: const home = fs.mkdtempSync(path.join(os.tmpdir(), "twing-cli-home-")); L50: const original = process.env.HOME; L51: process.env.HOME = home;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/test-support.jsView on unpkg · L34

dist/design.js#virtual:normalized:round1View file

Findings

5 High2 Medium4 Low

HighChild Processdist/spawn-daemon.js

HighShell

HighSame File Env Network Executiondist/test-support.js

HighSemantic Analysis Limiteddist/design.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/design.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @twing/cli@0.2.27.

See all versions of @twing/cli for other recorded verdicts.

Review the evidence and your use of @twing/cli@0.2.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 23:21:19.263Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.