registry / @vibelet/cli / 1.2.153

@vibelet/cli@1.2.153

⚠ Under review

Cross-platform CLI for installing and running the Vibelet daemon

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 308 file(s), 11.4 MB of source, external domains: 127.0.0.1, abc.trycloudflare.com, apps.apple.com, example.com, github.com, html.spec.whatwg.org, react.dev, registry.npmjs.org, vibelet.icu, vibelet.local, www.apple.com, www.feishu.cn, www.ibm.com, www.w3.org

Source & flagged code

2 flagged

dist/web/assets/codeql-DsOJ9woJ.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

Long lines were clipped for display.

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView file

189contains invisible/control Unicode U+200B (zero width space) `).at(-1);if(s&&s.trim().length>0)return`${e}<U+200B>`}if(aC.test(i)&&!n.match(oC)){let s=r.split(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/mermaid-O7DHMXV3-BA2glr4S.jsView on unpkg · L189

Source & flagged code

2 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code