registry / @uniqbit/mate / 0.14.3

@uniqbit/mate@0.14.3

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 199 file(s), 1.15 MB of source, external domains: 127.0.0.1, astral.sh, bun.sh, cobertura.sourceforge.net, git.example.test, github.com, gitlab.com, opencode.ai, registry.npmjs.org, rtk.ai

Source & flagged code

6 flagged

src/tools/setup/utils-run.test.tsView file

Lines 1-21typescript

1import { EventEmitter } from "node:events";

2import * as childProcess from "node:child_process";

High

Child Process

Package source references child process execution.

src/tools/setup/utils-run.test.tsView on unpkg · L1

4import { afterAll, afterEach, beforeEach, describe, expect, mock, test } from "bun:test";

6type ChildLike = EventEmitter;

8// Capture the real spawn as a plain value *before* mock.module() runs below.

9// `import { spawn as realSpawn }` would instead create a live binding that

10// re-reads the export slot on every reference — since mock.module() mutates

11// that same slot in place, the binding would end up pointing at our own mock

12// wrapper instead of the native implementation.

13const realSpawn = childProcess.spawn;

15let spawnImpl: (...args: unknown[]) => ChildLike;

17mock.module("node:child_process", () => ({

18 spawn: ((...args: unknown[]) => spawnImpl(...args)) as unknown as typeof childProcess.spawn,

19}));

21const { runCommand, runCommandSilently, runShellCommand } = await import("./utils");

Lines 54-86typescript

54 await expect(runCommand("uv", ["sync"], { cwd: "/tmp/project" })).rejects.toThrow(

55 "uv sync exited with code 2",

56 );

57 });

59 test("runCommandSilently rejects on non-zero exit codes"

src/cli/cli-e2e.test.tsView file

Lines 507-547typescript

507 "const capturePath = process.env.MATE_E2E_EDITOR_CAPTURE_PATH;",

508 "if (!capturePath) process.exit(2);",

509 'if (process.argv[2] === "--status") process.exit(0);',

510 "const payload = { cwd: process.cwd(), argv: process.argv.slice(2) };",

511 "fs.writeFileSync(capturePath, JSON.stringify(payload, null, 2));",

512 "process.exit(0);",

src/cli-bootstrap.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { execFileSync, spawnSync } = require("node:child_process");

3const os = require("node:os");

4const

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView file

•path = [redacted]-doctor/claude/hooks/react-doctor.sh kind = build_helper sizeBytes = 3018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/templates/capabilities/react-doctor/claude/hooks/react-doctor.shView on unpkg

Source & flagged code

6 flagged · loading source

src/tools/setup/utils-run.test.tsView file

1import { EventEmitter } from "node:events"; L2: import * as childProcess from "node:child_process"; L3:

High

Child Process

Package source references child process execution.

src/tools/setup/utils-run.test.tsView on unpkg · L1

74expect(command).toBe("echo hello"); L75: expect(options).toEqual({ cwd: "/tmp/project", stdio: "inherit", shell: true }); L76: const child = new EventEmitter();

High

Shell

Package source references shell execution.

src/tools/setup/utils-run.test.tsView on unpkg · L74

src/cli/cli-e2e.test.tsView file

527'import fs from "node:fs";', L528: 'import http from "node:http";', L529: 'import { spawnSync } from "node:child_process";', L530: "const args = process.argv.slice(2);", ... L537: "if (sub === 'add') {", L538: " const setupCapturePath = process.env.MATE_E2E_UV_CAPTURE_PATH;", L539: " if (setupCapturePath) {",

Findings

5 High5 Medium5 Low

HighChild Processsrc/tools/setup/utils-run.test.ts

HighShellsrc/tools/setup/utils-run.test.ts

HighSame File Env Network Executionsrc/cli/cli-e2e.test.ts

HighSandbox Evasion Gated Capabilitysrc/cli-bootstrap.cjs

HighPrevious Version Dangerous Deltasrc/cli/cli-e2e.test.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersrc/templates/capabilities/react-doctor/claude/hooks/react-doctor.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings