registry / @varveai/adit-cli / 1.0.1

@varveai/adit-cli@1.0.1

AI Development Intent Tracker — Transparent Time Machine for your codebase

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 77 file(s), 591 KB of source, external domains: 127.0.0.1, adit.cloud, registry.npmjs.org

Source & flagged code

5 flagged

dist/commands/self-update.jsView file

Lines 1-28javascript

1/**

2 * `adit upgrade` — Update ADIT to the latest version.

3 *

4 * Detects the installation directory (source-install via git clone),

5 * pulls the latest changes, rebuilds, and re-registers commands.

6 * Falls back to re-running the install script if the install dir

7 * cannot be determined.

8 */

9import { execSync } from "node:child_process";

10import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/self-update.jsView on unpkg · L8

11import { resolve, dirname } from "node:path";

12import { CLI_VERSION } from "../version.js";

13/** Default install location used by install.sh */

14const DEFAULT_INSTALL_DIR = resolve(process.env.ADIT_INSTALL_DIR ?? `${process.env.HOME ?? "~"}/.adit-core`);

15/**

16 * Resolve the adit-core install directory by walking up from the

17 * running CLI entry point to find the monorepo root.

18 */

19function resolveInstallDir() {

20 // Method 1: Walk up from the running script to find the monorepo root

21 // The CLI runs from <root>/packages/cli/dist/index.js

22 try {

23 const cliDist = dirname(process.argv[1] ?? "");

24 const candidate = resolve(cliDist, "../../..");

25 if (existsSync(resolve(candidate, "package.json")) &&

26 existsSync(resolve(candidate, ".git"))) {

27 return candidate;

28 }

Lines 104-144javascript

104 const showExecOpts = {

105 ...execOpts,

106 stdio: "inherit",

107 };

108 console.log(`Updating from v${CLI_VERSION} ...`);

109 console.log();

110 // Step 1: Pull

111 try {

dist/commands/cli-agent/cli-process.jsView file

Lines 59-99javascript

59 * when unavailable (non-Windows, bad pid, taskkill missing/failed) so callers

60 * can fall back to a plain kill().

61 */

62export function taskkillTree(pid) {

63 if (process.platform !== "win32")

dist/commands/cli-agent/claude/hooks-bootstrap.jsView file

Lines 1-37javascript

1import fs from "node:fs";

2import { connect } from "node:net";

3import { homedir } from "node:os";

4import path from "node:path";

5import { claudeCodeAdapter, resolveAditHookBinary, } from "@varveai/adit-hooks/adapters";

Source & flagged code

5 flagged · loading source

dist/commands/self-update.jsView file

8*/ L9: import { execSync } from "node:child_process"; L10: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/self-update.jsView on unpkg · L8

124console.log("Installing dependencies ..."); L125: execSync("pnpm install --frozen-lockfile", { L126: ...showExecOpts,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/self-update.jsView on unpkg · L124

dist/commands/cli-agent/cli-process.jsView file

79* Terminate a spawned CLI, including its descendants on Windows. `.cmd`/`.bat` L80: * shims run under a cmd.exe shell, so killing only the direct child leaves the L81: * real CLI (e.g. claude.exe) alive and still reading the console — which is

High

Shell

Package source references shell execution.

dist/commands/cli-agent/cli-process.jsView on unpkg · L79

dist/commands/cli-agent/claude/hooks-bootstrap.jsView file

17"try{", L18: "const cp=require('child_process'),http=require('http'),https=require('https');", L19: "const e=process.argv[1]?process.argv[1]:'',q=process.argv[2]?process.argv[2]:'',oc=process.argv[3]?Buffer.from(process.argv[3],'base64').toString('utf8'):'';", ... L26: "let p;", L27: "try{p=cp.spawn(oc,{shell:true,stdio:['pipe','pipe','ignore'],env:process.env})}catch{return done(o)}", L28: "let out='';",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/cli-agent/claude/hooks-bootstrap.jsView on unpkg · L17

17"try{", L18: "const cp=require('child_process'),http=require('http'),https=require('https');", L19: "const e=process.argv[1]?process.argv[1]:'',q=process.argv[2]?process.argv[2]:'',oc=process.argv[3]?Buffer.from(process.argv[3],'base64').toString('utf8'):'';", ... L22: "process.stdin.on('data',c=>{d+=c});", L23: "function done(o){if(o)process.stdout.write(o)}", L24: "function run(o){",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/cli-agent/claude/hooks-bootstrap.jsView on unpkg · L17

Findings

5 High3 Medium5 Low

HighChild Processdist/commands/self-update.js

HighShelldist/commands/cli-agent/cli-process.js

HighSame File Env Network Executiondist/commands/cli-agent/claude/hooks-bootstrap.js

HighCommand Output Exfiltrationdist/commands/cli-agent/claude/hooks-bootstrap.js

HighRuntime Package Installdist/commands/self-update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/commands/self-update.jsView file

Lines 1-28javascript

1/**

2 * `adit upgrade` — Update ADIT to the latest version.

3 *

4 * Detects the installation directory (source-install via git clone),

5 * pulls the latest changes, rebuilds, and re-registers commands.

6 * Falls back to re-running the install script if the install dir

7 * cannot be determined.

8 */

9import { execSync } from "node:child_process";

10import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/self-update.jsView on unpkg · L8

11import { resolve, dirname } from "node:path";

12import { CLI_VERSION } from "../version.js";

13/** Default install location used by install.sh */

14const DEFAULT_INSTALL_DIR = resolve(process.env.ADIT_INSTALL_DIR ?? `${process.env.HOME ?? "~"}/.adit-core`);

15/**

16 * Resolve the adit-core install directory by walking up from the

17 * running CLI entry point to find the monorepo root.

18 */

19function resolveInstallDir() {

20 // Method 1: Walk up from the running script to find the monorepo root

21 // The CLI runs from <root>/packages/cli/dist/index.js

22 try {

23 const cliDist = dirname(process.argv[1] ?? "");

24 const candidate = resolve(cliDist, "../../..");

25 if (existsSync(resolve(candidate, "package.json")) &&

26 existsSync(resolve(candidate, ".git"))) {

27 return candidate;

28 }

Lines 104-144javascript

104 const showExecOpts = {

105 ...execOpts,

106 stdio: "inherit",

107 };

108 console.log(`Updating from v${CLI_VERSION} ...`);

109 console.log();

110 // Step 1: Pull

111 try {

dist/commands/cli-agent/cli-process.jsView file

Lines 59-99javascript

59 * when unavailable (non-Windows, bad pid, taskkill missing/failed) so callers

60 * can fall back to a plain kill().

61 */

62export function taskkillTree(pid) {

63 if (process.platform !== "win32")

dist/commands/cli-agent/claude/hooks-bootstrap.jsView file

Lines 1-37javascript

1import fs from "node:fs";

2import { connect } from "node:net";

3import { homedir } from "node:os";

4import path from "node:path";

5import { claudeCodeAdapter, resolveAditHookBinary, } from "@varveai/adit-hooks/adapters";