registry / @vpxa/aikit / 0.1.491
@vpxa/aikit@0.1.491
⚠ Under reviewLocal-first AI developer toolkit — knowledge base, code analysis, context management, and developer tools for LLM agents
Static Scan Results
scanned 23d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/tools/dist/index.jsView file
1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BYpgxrwI.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n...
L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:...
High
Child Process
Package source references child process execution.
packages/tools/dist/index.jsView on unpkg · L11import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BYpgxrwI.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n...
L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:...
L3: `).trim()||t.message||`Command failed`}async function ot(e={}){if(it>=2)throw Error(`Too many concurrent check runs (${it}/2). Retry when one finishes or use targeted check({ files...
L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=/* @__PURE__ */ n...
L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[
Findings
9 High6 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpackages/tools/dist/index.js
HighShellpackages/server/dist/server-CjkkQPO7.js
HighSame File Env Network Executionpackages/server/dist/proxy.js
HighCloud Metadata Accesspackages/tools/dist/index.js
HighSemantic Analysis Limitedpackages/analyzers/dist/index.js#virtual:string-array:round1
HighKnown Malware Source Similaritypackages/claude-desktop/dist/light/server/index.mjs
HighKnown Malware Source Similaritypackages/server/dist/startup-maintenance-Djs0cxRl.js
HighPrevious Version Dangerous Deltapackages/cli/dist/index.js
MediumDynamic Requirebin/aikit.mjs
Medium
Affected versions and remediation
This report applies to @vpxa/aikit@0.1.491.
See all versions of @vpxa/aikit for other recorded verdicts.
- Review the evidence and your use of @vpxa/aikit@0.1.491 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.