registry / @untitledmarkdown/trace / 0.1.0

@untitledmarkdown/trace@0.1.0

Trace — record of work for AI coding agents. Install the full CLI with npm.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.06 KB of source, external domains: github.com, www.npmjs.com

Source & flagged code

4 flagged

package.jsonView file

Lines 17-49json

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/untitledmarkdown/trace.git"

20 },

21 "bugs": {

22

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/trace.jsView file

3L4: const { spawnSync } = require("child_process"); L5: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/trace.jsView on unpkg · L3

vendor/trace.exeView file

•path = vendor/trace.exe kind = native_binary sizeBytes = 10263040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/trace.exeView on unpkg

Findings

1 High6 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/trace.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/trace.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LPM CLI

Source & flagged code

4 flagged

package.jsonView file

Lines 17-49json

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/untitledmarkdown/trace.git"

20 },

21 "bugs": {

22

"url"

:

"https://github.com/untitledmarkdown/trace/issues"

23 },

24 "bin": {

25 "trace": "bin/trace.js"

26 },

27 "files": [

28 "bin",

29 "scripts",

30 "vendor",

31 "README.md"

32 ],

33 "engines": {

34 "node": ">=18"

35 },

36 "scripts": {

37 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ]

48}

49

bin/trace.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3

4const { spawnSync } = require("child_process");

5const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/trace.jsView on unpkg · L3

6const path = require("path");

7

8const vendor = path.join(__dirname, "..", "vendor");

9const binName = process.platform === "win32" ? "trace.exe" : "trace";

10const localBin = path.join(vendor, binName);

11

12function run(file, args) {

13 const r = spawnSync(file, args, { stdio: "inherit", shell: false });

14 process.exit(r.status === null ? 1 : r.status);

15}

16

17if (fs.existsSync(localBin)) {

18 run(localBin, process.argv.slice(2));

19}

20

21// Prefer a PATH-installed cargo binary from cargo install --locked --path .

22const which = process.platform === "win32" ? "where" : "which";

23const found = spawnSync(which, ["trace"], { encoding: "utf8" });

vendor/trace.exeView file

•path = vendor/trace.exe kind = native_binary sizeBytes = 10263040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/trace.exeView on unpkg