registry / arcie / 0.2.9

arcie@0.2.9

The electronic line — build agents at the speed of light.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 285 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, cencori.com, generativelanguage.googleapis.com

Source & flagged code

4 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-XKZL275B.jsView file

Lines 15-55javascript

15 visibleLength,

16 visibleLine

17} from "./chunk-HWD2Z2CH.js";

18import {

19 scaffoldWebChat

20} from "./chunk-WCY3PQEV.js";

22// src/cli/init.ts

23import {

24 copyFileSync,

25 existsSync,

26 mkdirSync,

27 readdirSync,

28 readFileSync,

29 rmSync,

30 statSync,

31 writeFileSync

32} from "fs";

33import { homedir } from "os";

34import { resolve, join, dirname } from "path";

35import { fileURLToPath } from "url";

36import { exec } from "child_process";

High

Child Process

Package source references child process execution.

dist/init-XKZL275B.jsView on unpkg · L35

38// src/cli/setup/select-input.ts

39function createSelectState(options, init = {}) {

40 const query = init.query ?? "";

41 const matches = filterOptions(options, query);

42 const initial = init.initialValue;

43 const selectedIndex = initial === void 0 ? 0 : Math.max(

44 0,

45 matches.findIndex((option) => option.value === initial)

46 );

47 return { options, matches, selectedIndex, query };

48}

49function setQuery(state, query) {

50 if (query === state.query) return state;

51 const matches = filterOptions(state.options, query);

52 const carried = state.matches[state.selectedIndex];

53 const carriedIndex = carried === void 0 ? -1 : matches.findIndex((option) => option.value === carried.value);

54 return {

55 options: state.options,

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

dist/dev-I27XVV5J.jsView file

Lines 2268-2308javascript

2268 const projectRoot = dirname(agentDir);

2269 const webDir = join2(projectRoot, "channels", "web");

2270 if (!existsSync2(join2(webDir, "package.json"))) return void

Source & flagged code

4 flagged · loading source

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-XKZL275B.jsView file

35import { fileURLToPath } from "url"; L36: import { exec } from "child_process"; L37:

High

Child Process

Package source references child process execution.

dist/init-XKZL275B.jsView on unpkg · L35

dist/chunk-QSJIS2NL.jsView file

17try { L18: const mod = await import(moduleSpecifier(agentFile, options.hotReload)); L19: if (mod.default) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QSJIS2NL.jsView on unpkg · L17

dist/dev-I27XVV5J.jsView file

2288} L2289: const child = spawn("npm", ["run", "dev"], { L2290: cwd: webDir, L2291: env: { L2292: ...process.env, L2293: ARCIE_AGENT_DIR: agentDir, ... L2298: }); L2299: const url = await readNextLocalUrl(child, 45e3) ?? `http://localhost:${portHint}`; L2300: const ready = await waitForHttp(url, 45e3);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev-I27XVV5J.jsView on unpkg · L2288

Findings

1 Critical3 High4 Medium5 Low

CriticalCritical Secrettemplates/default/.env.local

HighChild Processdist/init-XKZL275B.js

HighShell

HighSame File Env Network Executiondist/dev-I27XVV5J.js

MediumDynamic Requiredist/chunk-QSJIS2NL.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-XKZL275B.jsView file

Lines 15-55javascript

15 visibleLength,

16 visibleLine

17} from "./chunk-HWD2Z2CH.js";

18import {

19 scaffoldWebChat

20} from "./chunk-WCY3PQEV.js";

22// src/cli/init.ts

23import {

24 copyFileSync,

25 existsSync,

26 mkdirSync,

27 readdirSync,

28 readFileSync,

29 rmSync,

30 statSync,

31 writeFileSync

32} from "fs";

33import { homedir } from "os";

34import { resolve, join, dirname } from "path";

35import { fileURLToPath } from "url";

36import { exec } from "child_process";

High

Child Process

Package source references child process execution.

dist/init-XKZL275B.jsView on unpkg · L35

38// src/cli/setup/select-input.ts

39function createSelectState(options, init = {}) {

40 const query = init.query ?? "";

41 const matches = filterOptions(options, query);

42 const initial = init.initialValue;

43 const selectedIndex = initial === void 0 ? 0 : Math.max(

44 0,

45 matches.findIndex((option) => option.value === initial)

46 );

47 return { options, matches, selectedIndex, query };

48}

49function setQuery(state, query) {

50 if (query === state.query) return state;

51 const matches = filterOptions(state.options, query);

52 const carried = state.matches[state.selectedIndex];

53 const carriedIndex = carried === void 0 ? -1 : matches.findIndex((option) => option.value === carried.value);

54 return {

55 options: state.options,

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

dist/dev-I27XVV5J.jsView file

Lines 2268-2308javascript

2268 const projectRoot = dirname(agentDir);

2269 const webDir = join2(projectRoot, "channels", "web");

2270 if (!existsSync2(join2(webDir, "package.json"))) return void