registry / @x12i/xops / 3.7.0

@x12i/xops@3.7.0

Repository operating layer for Node.js tools, releases, and code agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 252 file(s), 1.11 MB of source, external domains: 127.0.0.1, api.bitbucket.org, api.github.com, aquasecurity.github.io, chatgpt.com, claude.ai, cli.github.com, gitbutler.com, github.com, gitlab.com, google.github.io, registry.npmjs.org, semgrep.dev

Source & flagged code

4 flagged

package.jsonView file

Lines 23-63json

23 "import": "./dist/cli.js"

24 },

25 "./mcp": {

26 "types": "./dist/mcp/server.d.ts",

27 "import": "./dist/mcp/server.js"

28 },

29 "./playbooks": {

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/scripts/renderPublishRunbook.jsView file

68`for pkgdir in ${pkgDirs.map((dir) => shellQuote(dir)).join(" ")}; do`, L69: ' name=$(node -p "require(process.argv[1]).name" "$pkgdir/package.json")', L70: ' local=$(node -p "require(process.argv[1]).version" "$pkgdir/package.json")',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/renderPublishRunbook.jsView on unpkg · L68

dist/tools/seamlessTools.jsView file

1import { spawnSync } from "node:child_process"; L2: import { runCommand } from "../execution/runCommand.js"; ... L8: binary: "but", L9: installCommand: process.platform === "win32" L10: ? undefined L11: : ["sh", "-c", "curl -fsSL https://gitbutler.com/install.sh | sh"], L12: updateCommand: process.platform === "win32" ... L24: function autoInstallEnabled() { L25: return process.env.XOPS_AUTO_INSTALL_TOOLS !== "0" && process.env.XOPS_NO_AUTO_INSTALL_TOOLS !== "1"; L26: } ... L33: } L34: export async function ensureSeamlessToolInstalled(id, cwd = process.cwd()) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools/seamlessTools.jsView on unpkg · L1

Findings

2 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/tools/seamlessTools.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/scripts/renderPublishRunbook.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/scripts/renderPublishRunbook.jsView file

Lines 48-88javascript

48 if (filters.length > 0) {

49 return filters.map((glob) => `--filter ${shellQuote(glob)}`).join(" ");

50 }

51 return "";

52}

53function renderReleaseCommand(options) {

54 const selector = releaseSelector(options);

55 // Prefer --publish-flow for multi-package trains: pack-check, ordered publish,

56 // verify-with-backoff. Never teach raw `npm publish` as the happy path.

57 return selector.length > 0

58 ? `xops --publish-flow ${selector} --report`

59 : "xops --publish-flow --report";

60}

61function renderVerifyBlock(repoRoot, allPackages) {

62 const pkgDirs = allPackages.map((pkg) => {

63 const dirRel = relDir(repoRoot, pkg.dir);

64 return dirRel === "." ? repoRoot : `${repoRoot}/${dirRel}`.replace(/\/+/g, "/");

65 });

66 return [

67 `cd ${shellQuote(repoRoot)}`,

68 `for pkgdir in ${pkgDirs.map((dir) => shellQuote(dir)).join(" ")}; do`,

69 ' name=$(node -p "require(process.argv[1]).name" "$pkgdir/package.json")',

70 ' local=$(node -p "require(process.argv[1]).version" "$pkgdir/package.json")',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/renderPublishRunbook.jsView on unpkg · L68

71 ' remote=$(npm view "$name" version 2>/dev/null || echo "not found")',

72 ' echo "$name: local=$local npm=$remote $([ "$local" = "$remote" ] && echo OK || echo MISMATCH)"',

73 "done",

74 ];

75}

76function verifyPackageCount(allPackages) {

77 return allPackages.length;

78}

79function renderExpectedVersions(publishPackages) {

80 if (publishPackages.length === 0) {

81 return [];

82 }

83 const lines = [

84 "",

85 "Expected versions for packages in the publish sequence:",

86 ];

87 for (const pkg of publishPackages) {

88 lines.push(`- ${pkg.name} → ${pkg.version}`);

dist/tools/seamlessTools.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { runCommand } from "../execution/runCommand.js";

3import { isSuccess } from "../execution/commandResult.js";

4export const SEAMLESS_TOOLS = [

5 {

6 id: "gitbutler",

7 displayName: "GitButler CLI",

8 binary: "but",

9 installCommand: process.platform === "win32"

10 ? undefined

11 : ["sh", "-c", "curl -fsSL https://gitbutler.com/install.sh | sh"],

12 updateCommand: process.platform === "win32"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools/seamlessTools.jsView on unpkg · L1

13 ? undefined

14 : ["sh", "-c", "curl -fsSL https://gitbutler.com/install.sh | sh"],

15 unsupportedReason: process.platform === "win32"

16 ? "automatic GitButler CLI install is not registered for Windows yet"

17 : undefined,

18 },

19];

20function commandAvailable(command) {

21 const lookup = process.platform === "win32" ? "where" : "which";