registry / @vigolium/vigolium / 0.1.44-beta

@vigolium/vigolium@0.1.44-beta

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

Manifest

CopyleftLicense

scanned 1 file(s), 5.97 KB of source, external domains: docs.vigolium.com

Source & flagged code

1 flagged

bin/vigolium.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Unified entry point for the Vigolium CLI distributed via npm.

3//

4// The platform-specific binary is shipped *gzipped* inside an optional

5// dependency package (one of @vigolium/vigolium-<tag>). On first run we

6// decompress it once into a version-scoped cache directory and then exec it,

7// forwarding args, stdio, signals and the exit status.

9import { spawn } from "node:child_process";

10import { createReadStream, createWriteStream, existsSync, statSync } from "node:fs";

11import { mkdir, rename, chmod, unlink } from "node:fs/promises";

12import { createRequire } from "node:module";

13import { pipeline } from "node:stream/promises";

14import { createGunzip } from "node:zlib";

15import os from "node:os";

16import path from "node:path";

17import { fileURLToPath } from "node:url";

19// __dirname / require equivalents in ESM.

20const __filename = fileURLToPath(import.meta.url);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vigolium.jsView on unpkg · L8

21const __dirname = path.dirname(__filename);

22const require = createRequire(import.meta.url);

24// Local alias (npm install path) -> nothing else; the underlying package

25// published to npm is always @vigolium/vigolium with a version suffix.

26const PLATFORM_PACKAGE_BY_TAG = {

27 "linux-x64": "@vigolium/vigolium-linux-x64",

28 "linux-arm64": "@vigolium/vigolium-linux-arm64",

Source & flagged code

1 flagged · loading source

bin/vigolium.jsView file

8L9: import { spawn } from "node:child_process"; L10: import { createReadStream, createWriteStream, existsSync, statSync } from "node:fs"; ... L13: import { pipeline } from "node:stream/promises"; L14: import { createGunzip } from "node:zlib"; L15: import os from "node:os"; ... L18: L19: // __dirname / require equivalents in ESM. L20: const __filename = fileURLToPath(import.meta.url); ... L35: function detectPackageManager() { L36: const userAgent = process.env.npm[redacted] || ""; L37: if (/\bbun\//.test(userAgent)) return "bun";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vigolium.jsView on unpkg · L8

Findings

1 High1 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/vigolium.js

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

LowCopyleft License

Source & flagged code

1 flagged

bin/vigolium.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// Unified entry point for the Vigolium CLI distributed via npm.

3//

4// The platform-specific binary is shipped *gzipped* inside an optional

5// dependency package (one of @vigolium/vigolium-<tag>). On first run we

6// decompress it once into a version-scoped cache directory and then exec it,

7// forwarding args, stdio, signals and the exit status.

9import { spawn } from "node:child_process";

10import { createReadStream, createWriteStream, existsSync, statSync } from "node:fs";

11import { mkdir, rename, chmod, unlink } from "node:fs/promises";

12import { createRequire } from "node:module";

13import { pipeline } from "node:stream/promises";

14import { createGunzip } from "node:zlib";

15import os from "node:os";

16import path from "node:path";

17import { fileURLToPath } from "node:url";

19// __dirname / require equivalents in ESM.

20const __filename = fileURLToPath(import.meta.url);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/vigolium.jsView on unpkg · L8

21const __dirname = path.dirname(__filename);

22const require = createRequire(import.meta.url);

24// Local alias (npm install path) -> nothing else; the underlying package

25// published to npm is always @vigolium/vigolium with a version suffix.

26const PLATFORM_PACKAGE_BY_TAG = {

27 "linux-x64": "@vigolium/vigolium-linux-x64",

28 "linux-arm64": "@vigolium/vigolium-linux-arm64",