registry / @yhong91/vibetime / 0.1.28

@yhong91/vibetime@0.1.28

vibetime CLI — install AI-agent hooks (Claude Code, Codex, OpenCode, Pi) and report activity to vibetime.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 398 KB of source, external domains: 121.196.224.82, registry.npmjs.org, vibetime.dev

Source & flagged code

4 flagged

bin/vibetime.mjsView file

Lines 105-145javascript

105 const entryPath = path3.join(rootPath, entry.name);

106 if (entry.isDirectory()) {

107 return listFilesByExtensions(entryPath, extensions);

108 }

109 return entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext)) ? [entryPath] : [];

110 }));

111 return files.flat().sort();

112}

113async function countDirectoryEntries(candidatePath) {

114 try {

115 const info = await stat(candidatePath);

116 if (!info.isDirectory()) {

117 if (candidatePath.endsWith(".jsonl")) {

118 const text = await readFile(candidatePath, "utf8");

119 return text.split("\n").filter(Boolean).length;

120 }

121 if (candidatePath.endsWith(".json")) {

122 return 1;

123 }

124 if (candidatePath.endsWith(".db")) {

125 try {

126 const { DatabaseSync } = await import("node:sqlite");

127 const db = new DatabaseSync(candidatePath, { readOnly: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/vibetime.mjsView on unpkg · L125

128 try {

129 const result = db.prepare(

130 "SELECT count(*) as cnt FROM session WHERE time_created IS NOT NULL"

131 ).get();

132 return result?.cnt || 0;

133 } finally {

134 db.close();

135 }

136 } catch {

137 return 0;

138 }

139 }

140 return 1;

141 }

142 const files = await listFilesByExtensions(candidatePath, [".jsonl", ".json"]);

143 return files.length;

144 } catch (error) {

145 if (error.code === "ENOENT") {

Lines 865-905javascript

865 } else {

866 this.ondata(blk, false);

867 cpw(this.s.w, 0, blk.length);

868 this.s.w.set(blk, this.s.w.length

Lines 2402-2442javascript

2402 }

2403 });

2404 });

2405}

2406async function readLegacyAgyGeneratorMetadata(transcriptPath, sessionId) {

2407 const antigravityCliDir = path4.resolve(path4.dirname

Lines 10991-11031javascript

10991 write(ctx.stdout, "Checking npm registry...\n");

10992 const latest = await fetchLatestVersion();

10993 if (!latest) {

10994 write(ctx.stderr, "Could not fetch latest version from npm. Check your network connection.

Source & flagged code

4 flagged · loading source

bin/vibetime.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code