registry / arcie / 0.2.5

arcie@0.2.5

The electronic line — build agents at the speed of light.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 269 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, cencori.com, generativelanguage.googleapis.com

Source & flagged code

5 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-DANPECQB.jsView file

Lines 15-55javascript

15 visibleLength,

16 visibleLine

17} from "./chunk-HWD2Z2CH.js";

18import {

19 scaffoldWebChat

20} from "./chunk-WCY3PQEV.js";

22// src/cli/init.ts

23import {

24 copyFileSync,

25 existsSync,

26 mkdirSync,

27 readdirSync,

28 readFileSync,

29 rmSync,

30 statSync,

31 writeFileSync

32} from "fs";

33import { homedir } from "os";

34import { resolve, join, dirname } from "path";

35import { fileURLToPath } from "url";

36import { exec } from "child_process";

High

Child Process

Package source references child process execution.

dist/init-DANPECQB.jsView on unpkg · L35

38// src/cli/setup/select-input.ts

39function createSelectState(options, init = {}) {

40 const query = init.query ?? "";

41 const matches = filterOptions(options, query);

42 const initial = init.initialValue;

43 const selectedIndex = initial === void 0 ? 0 : Math.max(

44 0,

45 matches.findIndex((option) => option.value === initial)

46 );

47 return { options, matches, selectedIndex, query };

48}

49function setQuery(state, query) {

50 if (query === state.query) return state;

51 const matches = filterOptions(state.options, query);

52 const carried = state.matches[state.selectedIndex];

53 const carriedIndex = carried === void 0 ? -1 : matches.findIndex((option) => option.value === carried.value);

54 return {

55 options: state.options,

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

dist/dev-BLUGE36L.jsView file

Lines 2180-2220javascript

2180 stdio: "ignore"

2181 });

2182 child.once("exit", (code) => resolve2(code === 0));

2183 child.once("error", () => resolve2(false));

2184 });

Source & flagged code

5 flagged · loading source

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-DANPECQB.jsView file

35import { fileURLToPath } from "url"; L36: import { exec } from "child_process"; L37:

High

Child Process

Package source references child process execution.

dist/init-DANPECQB.jsView on unpkg · L35

dist/chunk-QSJIS2NL.jsView file

17try { L18: const mod = await import(moduleSpecifier(agentFile, options.hotReload)); L19: if (mod.default) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QSJIS2NL.jsView on unpkg · L17

dist/dev-BLUGE36L.jsView file

2200} L2201: const child = spawn("npm", ["run", "dev"], { L2202: cwd: webDir, L2203: env: { L2204: ...process.env, L2205: ARCIE_AGENT_DIR: agentDir, ... L2210: }); L2211: const url = `http://localhost:${webPort}`; L2212: const ready = await waitForHttp(url, 45e3);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev-BLUGE36L.jsView on unpkg · L2200

•matchType = previous_version_dangerous_delta matchedPackage = arcie@0.1.4 matchedIdentity = npm:YXJjaWU:0.1.4 similarity = 0.852 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dev-BLUGE36L.jsView on unpkg

Findings

1 Critical4 High4 Medium5 Low

CriticalCritical Secrettemplates/default/.env.local

HighChild Processdist/init-DANPECQB.js

HighShell

HighSame File Env Network Executiondist/dev-BLUGE36L.js

HighPrevious Version Dangerous Deltadist/dev-BLUGE36L.js

MediumDynamic Requiredist/chunk-QSJIS2NL.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-DANPECQB.jsView file

Lines 15-55javascript

15 visibleLength,

16 visibleLine

17} from "./chunk-HWD2Z2CH.js";

18import {

19 scaffoldWebChat

20} from "./chunk-WCY3PQEV.js";

22// src/cli/init.ts

23import {

24 copyFileSync,

25 existsSync,

26 mkdirSync,

27 readdirSync,

28 readFileSync,

29 rmSync,

30 statSync,

31 writeFileSync

32} from "fs";

33import { homedir } from "os";

34import { resolve, join, dirname } from "path";

35import { fileURLToPath } from "url";

36import { exec } from "child_process";

High

Child Process

Package source references child process execution.

dist/init-DANPECQB.jsView on unpkg · L35

38// src/cli/setup/select-input.ts

39function createSelectState(options, init = {}) {

40 const query = init.query ?? "";

41 const matches = filterOptions(options, query);

42 const initial = init.initialValue;

43 const selectedIndex = initial === void 0 ? 0 : Math.max(

44 0,

45 matches.findIndex((option) => option.value === initial)

46 );

47 return { options, matches, selectedIndex, query };

48}

49function setQuery(state, query) {

50 if (query === state.query) return state;

51 const matches = filterOptions(state.options, query);

52 const carried = state.matches[state.selectedIndex];

53 const carriedIndex = carried === void 0 ? -1 : matches.findIndex((option) => option.value === carried.value);

54 return {

55 options: state.options,

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

dist/dev-BLUGE36L.jsView file

Lines 2180-2220javascript

2180 stdio: "ignore"

2181 });

2182 child.once("exit", (code) => resolve2(code === 0));

2183 child.once("error", () => resolve2(false));

2184 });