registry / altimate-code / 0.9.2

altimate-code@0.9.2

The AI-native data engineering agent for the terminal

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 884 KB of source, external domains: altimate-code.dev, github.com, goo.gl, jimmy.warting.se

Source & flagged code

8 flagged

package.jsonView file

Lines 1-35json

2 "name": "altimate-code",

3 "description": "The AI-native data engineering agent for the terminal",

4 "repository": {

5 "type": "git",

6 "url": "git+https://github.com/AltimateAI/altimate-code.git"

7 },

8 "homepage": "https://github.com/AltimateAI/altimate-code#readme",

9 "bugs": "https://github.com/AltimateAI/altimate-code/issues",

10 "bin": {

11 "altimate": "./bin/altimate",

12 "altimate-code": "./bin/altimate-code"

13 },

14 "scripts": {

15 "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "version": "0.9.2",

18 "license": "MIT",

19 "dependencies": {

20 "@altimateai/altimate-core": "0.5.1"

21 },

22 "optionalDependencies": {

23 "@altimateai/altimate-code-linux-arm64": "0.9.2",

24 "@altimateai/altimate-code-linux-x64-baseline": "0.9.2",

25 "@altimateai/altimate-code-linux-x64": "0.9.2",

26 "@altimateai/altimate-code-windows-x64": "0.9.2",

27 "@altimateai/altimate-code-darwin-x64-baseline": "0.9.2",

28 "@altimateai/altimate-code-darwin-arm64": "0.9.2",

29 "@altimateai/altimate-code-darwin-x64": "0.9.2",

30 "@altimateai/altimate-code-windows-x64-baseline": "0.9.2"

31 },

32 "peerDependencies": {

33 "pg": ">=8",

34 "snowflake-sdk": ">=1",

35 "@google-cloud/bigquery": ">=8",

dbt-tools/dist/index.jsView file

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path";

High

Child Process

Package source references child process execution.

dbt-tools/dist/index.jsView on unpkg · L68

24057// src/index.ts L24058: import { join as join8, resolve as resolve4 } from "path"; L24059: import { existsSync as existsSync7 } from "fs"; ... L24065: import { existsSync } from "fs"; L24066: import { execFileSync } from "child_process"; L24067: function configDir() { L24068: return join(process.env.HOME || homedir(), ".altimate-code"); L24069: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dbt-tools/dist/index.jsView on unpkg · L24057

2028var methodName = "on" + name.toLowerCase(); L2029: var method = util.global[methodName]; L2030: if (!method)

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dbt-tools/dist/index.jsView on unpkg · L2028

917return obj; L918: eval(obj); L919: }

dbt-tools/dist/node_python_bridge.pyView file

•path = dbt-tools/dist/node_python_bridge.py kind = build_helper sizeBytes = 3745 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dbt-tools/dist/node_python_bridge.pyView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code