registry / @verboo/code / 0.14.2

@verboo/code@0.14.2

Verboo Code — coding agent for the Verboo platform

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 259 KB of source

Oversized source lightweight scan

dist/cli.mjs20.0 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsShellHighEntropyStrings

Source & flagged code

4 flagged

package.jsonView file

Lines 7-47json

7 "verboo": "bin/verboo"

8 },

9 "exports": {

10 "./package.json": "./package.json",

11 "./dist/cli.mjs": "./dist/cli.mjs",

12 "./sdk": {

13 "types": "./src/entrypoints/sdk.d.ts",

14 "import": "./dist/sdk.mjs"

15 }

16 },

17 "files": [

18 "bin/verboo",

19 "bin/import-specifier.mjs",

20 "dist/cli.mjs",

21 "dist/vendor/ripgrep/**",

22 "scripts/postinstall.mjs",

23 "README.md"

24 ],

25 "scripts": {

26 "build": "bun run scripts/build.ts",

27 "postinstall": "node scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "integrations:generate": "bun run scripts/generate-integrations-artifacts.ts",

29 "integrations:check": "bun run scripts/generate-integrations-artifacts.ts --check",

30 "dev": "bun run build && node dist/cli.mjs",

31 "dev:profile": "bun run scripts/provider-launch.ts",

32 "dev:profile:fast": "bun run scripts/provider-launch.ts auto --fast --bare",

33 "dev:codex": "bun run scripts/provider-launch.ts codex",

34 "dev:openai": "bun run scripts/provider-launch.ts openai",

35 "dev:gemini": "bun run scripts/provider-launch.ts gemini",

36 "dev:ollama": "bun run scripts/provider-launch.ts ollama",

37 "dev:ollama:fast": "bun run scripts/provider-launch.ts ollama --fast --bare",

38 "dev:atomic-chat": "bun run scripts/provider-launch.ts atomic-chat",

39 "profile:init": "bun run scripts/provider-bootstrap.ts",

40 "profile:recommend": "bun run scripts/provider-recommend.ts",

41 "profile:auto": "bun run scripts/provider-recommend.ts --apply",

42 "profile:codex": "bun run profile:init -- --provider codex --model codexplan",

43 "profile:fast": "bun run profile:init -- --provider ollama --model llama3.2:3b",

44 "profile:code": "bun run profile:init -- --provider ollama --model qwen2.5-coder:7b",

45 "dev:fast": "bun run profile:fast && bun run dev:ollama:fast",

46 "dev:code": "bun run profile:code && bun run dev:profile",

47 "dev:grpc": "bun run scripts/start-grpc.ts",

dist/cli.mjsView file

•path = dist/cli.mjs kind = oversized_source_file sizeBytes = 21016578 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.mjsView on unpkg

•path = dist/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 21016578 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.mjsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code