registry / @volter/supercode / 0.5.222

@volter/supercode@0.5.222

Volter Harness: a lightweight, customizable AI coding agent CLI — any model via OpenRouter; natively continues Claude Code and Codex sessions.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 41.1 KB of source, external domains: github.com

Source & flagged code

1 flagged

bin/supercode.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// The `supercode` front door. A command that has moved to TypeScript (lib/commands.mjs) is served here, in Node; every

3// other command goes to the native binary, which ships in a platform-specific optional dependency

4// (`@volter/supercode-cli-<os>-<cpu>`, npm installs only the one matching the host), with argv, stdio (so the

5// interactive REPL/TTY works) and the exit code forwarded as before (arc t_08d00e09, route step 2).

6"use strict";

8const { spawnSync } = require("child_process");

9const { pathToFileURL } = require("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/supercode.jsView on unpkg · L7

10const path = require("path");

12const platform = process.platform; // darwin | linux | win32 | ...

13const arch = process.arch; // arm64 | x64 | ...

14const pkg = `@volter/supercode-cli-${platform}-${arch}`;

15const binName = platform === "win32" ? "supercode.exe" : "supercode";

17/** The native binary's path, or null when no platform package is installed. */

18function nativeBinary() {

19 try {

20 return require.resolve(`${pkg}/bin/${binName}`);

21 } catch {

22 return null;

23 }

24}

26function runNative(args) {

27 const binPath = nativeBinary();

Source & flagged code

1 flagged · loading source

bin/supercode.jsView file

7L8: const { spawnSync } = require("child_process"); L9: const { pathToFileURL } = require("url");

@volter/supercode@0.5.222

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code