registry / @xevy/cli / 0.1.3

@xevy/cli@0.1.3

Xevy CLI — `xevy setup` installs the pi agent + the Xevy pi extension and stores your API key; `xevy` opens pi with it.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 9.83 KB of source, external domains: xevy.ai, xevy.vyte.dev

Source & flagged code

1 flagged

bin/xevy.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * @xevy/cli — the `xevy` command.

4 *

5 * xevy setup Install the pi agent (if missing), download the Xevy pi

6 * extension into ~/.xevy/extensions, and store your API key.

7 * xevy Open pi with the Xevy extensions from ~/.xevy/extensions.

8 * xevy pi (alt) Install the split model + MCP extensions into pi's own

9 * extensions dir, authenticated via OAuth.

10 *

11 * `xevy setup` is the default flow: it fetches `xevy.ts` from the server and

12 * asks for an API key (with a direct link to the exact page to generate one),

13 * stored in ~/.config/xevy/credentials. Then `xevy` launches pi with it.

14 */

15import { spawnSync } from "node:child_process";

16import fs from "node:fs";

17import os from "node:os";

18import path from "node:path";

19import readline from "node:readline";

20import { fileURLToPath } from "node:url";

22const here = path.dirname(fileURLToPath(import.meta.url));

23const pkgRoot = path.resolve(here, "..");

25const DEFAULT_BASE = "https://xevy.ai";

26const isWindows = process.platform === "win32";

28const PI_PACKAGE = "@mariozechner/pi-coding-agent";

29const PI_BIN = isWindows ? "pi.cmd" : "pi";

31// Where `xevy setup` installs the extension and `xevy` loads it from.

32const XEVY_EXTENSIONS_DIR = path.join(os.homedir(), ".xevy", "extensions");

33const XEVY_EXTENSION_FILE = "xevy.ts";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L14

34const API_KEY_PREFIX = "xevy_pk_";

Source & flagged code

1 flagged · loading source

bin/xevy.mjsView file

14*/ L15: import { spawnSync } from "node:child_process"; L16: import fs from "node:fs"; ... L24: L25: const DEFAULT_BASE = "https://xevy.ai"; L26: const isWindows = process.platform === "win32"; L27: ... L31: // Where `xevy setup` installs the extension and `xevy` loads it from. L32: const XEVY_EXTENSIONS_DIR = path.join(os.homedir(), ".xevy", "extensions"); L33: const XEVY_EXTENSION_FILE = "xevy.ts"; ... L37: const CREDENTIALS_DIR = path.join( L38: process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L14

Findings

1 High2 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/xevy.mjs

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

bin/xevy.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * @xevy/cli — the `xevy` command.

4 *

5 * xevy setup Install the pi agent (if missing), download the Xevy pi

6 * extension into ~/.xevy/extensions, and store your API key.

7 * xevy Open pi with the Xevy extensions from ~/.xevy/extensions.

8 * xevy pi (alt) Install the split model + MCP extensions into pi's own

9 * extensions dir, authenticated via OAuth.

10 *

11 * `xevy setup` is the default flow: it fetches `xevy.ts` from the server and

12 * asks for an API key (with a direct link to the exact page to generate one),

13 * stored in ~/.config/xevy/credentials. Then `xevy` launches pi with it.

14 */

15import { spawnSync } from "node:child_process";

16import fs from "node:fs";

17import os from "node:os";

18import path from "node:path";

19import readline from "node:readline";

20import { fileURLToPath } from "node:url";

22const here = path.dirname(fileURLToPath(import.meta.url));

23const pkgRoot = path.resolve(here, "..");

25const DEFAULT_BASE = "https://xevy.ai";

26const isWindows = process.platform === "win32";

28const PI_PACKAGE = "@mariozechner/pi-coding-agent";

29const PI_BIN = isWindows ? "pi.cmd" : "pi";

31// Where `xevy setup` installs the extension and `xevy` loads it from.

32const XEVY_EXTENSIONS_DIR = path.join(os.homedir(), ".xevy", "extensions");

33const XEVY_EXTENSION_FILE = "xevy.ts";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/xevy.mjsView on unpkg · L14

34const API_KEY_PREFIX = "xevy_pk_";