registry / @vitos-pizza/vitos-pizza / 0.2.0

@vitos-pizza/vitos-pizza@0.2.0

Vito's Pizzeria — a Pi distribution (Garfield-approved)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 291 KB of source, external domains: api.firecrawl.dev, api.search.brave.com, api.tavily.com, mcp.exa.ai, r.jina.ai

Source & flagged code

2 flagged

package.jsonView file

Lines 1-41json

2 "name": "@vitos-pizza/vitos-pizza",

3 "version": "0.2.0",

4 "description": "Vito's Pizzeria — a Pi distribution (Garfield-approved)",

5 "publishConfig": {

6 "access": "public",

Source & flagged code

2 flagged · loading source

package.jsonView file

•dependencies changed=@vitos-pizza/agent-mode,@vitos-pizza/keybindings,@vitos-pizza/permission-system,@vitos-pizza/question,@vitos-pizza/session-title,@vitos-pizza/subagents,@vitos-pizza/todoist,@vitos-pizza/ui-enhancements

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/sync-pi-manifest.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High3 Medium4 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings