registry / @varveai/adit-cloud / 0.5.7

@varveai/adit-cloud@0.5.7

Cloud sync client for ADIT — device auth, incremental push, conflict resolution

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 137 KB of source, external domains: adit-cloud.varve.ai

Source & flagged code

2 flagged

dist/project-link/auto-link.jsView file

Lines 1-37javascript

1/**

2 * Automatic project-link sync — fire-and-forget on session-start.

3 *

4 * Spawns a detached child process to run the full project-link flow

5 * (branches, commits, documents) in the background. The process is

6 * independent of the hook — it won't be killed by the 10-second

7 * hook timeout and won't block the AI agent.

8 *

9 * Precondition checks (all must pass to trigger):

10 * 1. Auto-sync not disabled via ADIT_PROJECT_LINK_AUTO_SYNC=false

11 * 2. Valid credentials exist (env token or stored credentials)

12 * 3. Server URL is resolvable

13 * 4. Cached project-link data is stale (older than staleHours)

14 *

15 * The detached process runs `npx adit cloud link --json --skip-qualify`

16 * with inherited environment, so credentials and config are available.

17 */

18import { spawn } from "node:child_process";

19import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/project-link/auto-link.jsView on unpkg · L17

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/project-link/auto-link.jsView on unpkg · L14

20import { loadCloudConfig, DEFAULT_SERVER_URL } from "../config.js";

21import { loadCredentials, credentialsFromEnvToken, isSyncDisabled, } from "../auth/credentials.js";

22import { getProjectLinkCache } from "./cache.js";

23import { runGit } from "@varveai/adit-engine";

24export const REFS_FINGERPRINT_CACHE_KEY = "__adit_git_refs_fingerprint";

25/**

26 * Trigger a background project-link sync if credentials exist and the

27 * cached link data is stale or git refs changed since the last check.

28 *

29 * This function is designed to be called as fire-and-forget:

30 * triggerProjectLinkSync(db, projectId, projectRoot).catch(() => {})

31 *

32 * It spawns a fully detached child process that outlives the hook

33 * process, so the 10-second hook timeout does not apply.

34 */

35export async function triggerProjectLinkSync(db, projectId, projectRoot) {

36 const cloudConfig = loadCloudConfig();

37 // 0. Check if project-link auto-sync is enabled

Source & flagged code

2 flagged · loading source

dist/project-link/auto-link.jsView file

17*/ L18: import { spawn } from "node:child_process"; L19: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/project-link/auto-link.jsView on unpkg · L17

14* L15: * The detached process runs `npx adit cloud link --json --skip-qualify` L16: * with inherited environment, so credentials and config are available. L17: */ L18: import { spawn } from "node:child_process"; L19: import { createHash } from "node:crypto";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/project-link/auto-link.jsView on unpkg · L14

Findings

3 High3 Medium5 Low

HighChild Processdist/project-link/auto-link.js

HighShell

HighRuntime Package Installdist/project-link/auto-link.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/project-link/auto-link.jsView file

Lines 1-37javascript

1/**

2 * Automatic project-link sync — fire-and-forget on session-start.

3 *

4 * Spawns a detached child process to run the full project-link flow

5 * (branches, commits, documents) in the background. The process is

6 * independent of the hook — it won't be killed by the 10-second

7 * hook timeout and won't block the AI agent.

8 *

9 * Precondition checks (all must pass to trigger):

10 * 1. Auto-sync not disabled via ADIT_PROJECT_LINK_AUTO_SYNC=false

11 * 2. Valid credentials exist (env token or stored credentials)

12 * 3. Server URL is resolvable

13 * 4. Cached project-link data is stale (older than staleHours)

14 *

15 * The detached process runs `npx adit cloud link --json --skip-qualify`

16 * with inherited environment, so credentials and config are available.

17 */

18import { spawn } from "node:child_process";

19import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/project-link/auto-link.jsView on unpkg · L17

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/project-link/auto-link.jsView on unpkg · L14

20import { loadCloudConfig, DEFAULT_SERVER_URL } from "../config.js";

21import { loadCredentials, credentialsFromEnvToken, isSyncDisabled, } from "../auth/credentials.js";

22import { getProjectLinkCache } from "./cache.js";

23import { runGit } from "@varveai/adit-engine";

24export const REFS_FINGERPRINT_CACHE_KEY = "__adit_git_refs_fingerprint";

25/**

26 * Trigger a background project-link sync if credentials exist and the

27 * cached link data is stale or git refs changed since the last check.

28 *

29 * This function is designed to be called as fire-and-forget:

30 * triggerProjectLinkSync(db, projectId, projectRoot).catch(() => {})

31 *

32 * It spawns a fully detached child process that outlives the hook

33 * process, so the 10-second hook timeout does not apply.

34 */

35export async function triggerProjectLinkSync(db, projectId, projectRoot) {

36 const cloudConfig = loadCloudConfig();

37 // 0. Check if project-link auto-sync is enabled