registry / @weirdmm/olliecli / 0.17.1

@weirdmm/olliecli@0.17.1

OllieChat in your terminal — a warm, streaming AI CLI with workspace, web search and command execution.

Static Scan Results

scanned 42m ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 68.4 KB of source, external domains: api.duckduckgo.com, html.duckduckgo.com, olliechat-lac.vercel.app, registry.npmjs.org, sh00t.host

Source & flagged code

1 flagged

dist/chunk-35QJORM2.jsView file

Lines 90-130javascript

90}

91var EFFORTS = [

92 { v: "off", label: "Off", sub: "answer directly" },

93 { v: "low", label: "Low", sub: "a quick think" },

94 { v: "medium", label: "Medium", sub: "balanced" },

95 { v: "high", label: "High", sub: "think it through" },

96 { v: "xhigh", label: "Max", sub: "think hardest" }

97];

98function modelById(id) {

99 return MODELS.find((m) => m.id === id);

100}

101function resolveModel(hint) {

102 const h = hint.trim().toLowerCase();

103 return MODELS.find((m) => m.id.toLowerCase() === h) || MODELS.find((m) => m.name.toLowerCase() === h) || MODELS.find((m) => m.id.toLowerCase().includes(h) || m.name.toLowerCase().includes(h));

104}

105

106// src/config.ts

107import { homedir } from "os";

108import { join } from "path";

109import { readFileSync } from "fs";

110import { mkdir, readFile, writeFile } from "fs/promises";

111var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, "");

112var UPSTREAM_BASE = "https://sh00t.host/v1";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-35QJORM2.jsView on unpkg · L110

113var GATEWAY_BASE = `${SITE_BASE}/v1`;

114var API_BASE = process.env.OLLIE_API_BASE || GATEWAY_BASE;

115var API_KEY = process.env.OLLIE_API_KEY || "";

116var BASE_PINNED = !!process.env.OLLIE_API_BASE;

117function setUpstream(base, key) {

118 if (BASE_PINNED) return;

119 API_BASE = base;

120 API_KEY = key;

121}

122var PKG_NAME = "@weirdmm/olliecli";

123function authHeaders() {

124 const h = { "Content-Type": "application/json" };

125 if (API_KEY) h.Authorization = `Bearer ${API_KEY}`;

126 return h;

127}

128var DEFAULT_SYSTEM = "You are Ollie, a warm, sharp, plainspoken assistant working inside the user's terminal. Be genuinely helpful and friendly without being fake or fawning. Give concrete answers over hedging, admit uncertainty when it is real, and skip filler. You have tools to read and write files in the current workspace, run shell commands, search the web, and fetch URLs \u2014 use them when they help. Prefer showing your work with real file edits and command output over describing what you would do. Use Markdown when it genuinely helps readability.";

129var DEFAULTS = {

130 model: DEFAULT_MODEL,

Source & flagged code

1 flagged · loading source

dist/chunk-35QJORM2.jsView file

110import { mkdir, readFile, writeFile } from "fs/promises"; L111: var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, ""); L112: var UPSTREAM_BASE = "https://sh00t.host/v1"; ... L149: } L150: var CONFIG_DIR = join(homedir(), ".olliechat"); L151: var CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L154: const raw = await readFile(CONFIG_PATH, "utf8"); L155: return { ...DEFAULTS, ...JSON.parse(raw) }; L156: } catch { ... L169: import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises"; L170: import { spawn } from "child_process"; L171: var DIR = join2(homedir2(), ".olliechat");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-35QJORM2.jsView on unpkg · L110

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/chunk-35QJORM2.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/chunk-35QJORM2.jsView file

Lines 90-130javascript

90}

91var EFFORTS = [

92 { v: "off", label: "Off", sub: "answer directly" },

93 { v: "low", label: "Low", sub: "a quick think" },

94 { v: "medium", label: "Medium", sub: "balanced" },

95 { v: "high", label: "High", sub: "think it through" },

96 { v: "xhigh", label: "Max", sub: "think hardest" }

97];

98function modelById(id) {

99 return MODELS.find((m) => m.id === id);

100}

101function resolveModel(hint) {

102 const h = hint.trim().toLowerCase();

103 return MODELS.find((m) => m.id.toLowerCase() === h) || MODELS.find((m) => m.name.toLowerCase() === h) || MODELS.find((m) => m.id.toLowerCase().includes(h) || m.name.toLowerCase().includes(h));

104}

105

106// src/config.ts

107import { homedir } from "os";

108import { join } from "path";

109import { readFileSync } from "fs";

110import { mkdir, readFile, writeFile } from "fs/promises";

111var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, "");

112var UPSTREAM_BASE = "https://sh00t.host/v1";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-35QJORM2.jsView on unpkg · L110

113var GATEWAY_BASE = `${SITE_BASE}/v1`;

114var API_BASE = process.env.OLLIE_API_BASE || GATEWAY_BASE;

115var API_KEY = process.env.OLLIE_API_KEY || "";

116var BASE_PINNED = !!process.env.OLLIE_API_BASE;

117function setUpstream(base, key) {

118 if (BASE_PINNED) return;

119 API_BASE = base;

120 API_KEY = key;

121}

122var PKG_NAME = "@weirdmm/olliecli";

123function authHeaders() {

124 const h = { "Content-Type": "application/json" };

125 if (API_KEY) h.Authorization = `Bearer ${API_KEY}`;

126 return h;

127}

129var DEFAULTS = {

130 model: DEFAULT_MODEL,