registry / ashlr-plugin / 1.37.1
ashlr-plugin@1.37.1
⚠ Under reviewMulti-host AI coding efficiency layer for Codex and Claude Code, powered by @ashlr/core-efficiency.
Static Scan Results
scanned 10d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
6 flaggedhooks/pulse-emit.tsView file
33import { createHash } from "crypto";
L34: import { spawnSync } from "child_process";
L35:
High
Child Process
Package source references child process execution.
hooks/pulse-emit.tsView on unpkg · L33hooks/pretooluse-budget-guard.tsView file
168try {
L169: const { appendFileSync, mkdirSync } = require("fs");
L170: const { dirname } = require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
hooks/pretooluse-budget-guard.tsView on unpkg · L168scripts/upgrade-flow.tsView file
26import { join } from "path";
L27: import { spawn } from "child_process";
L28: import * as readline from "readline";
...
L37:
L38: const API_URL = process.env["ASHLR_API_URL"] ?? "https://api.ashlr.ai";
L39: const SITE_URL = process.env["ASHLR_SITE_URL"] ?? "https://plugin.ashlr.ai";
Findings
5 High6 Medium4 Low
HighChild Processhooks/pulse-emit.ts
HighShell
HighSame File Env Network Executionscripts/upgrade-flow.ts
HighSandbox Evasion Gated Capabilityscripts/ollama-setup.ts
HighSemantic Analysis Limitedhooks/session-start.ts#virtual:normalized:round1
MediumDynamic Requirehooks/pretooluse-budget-guard.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbench/refs/python-lib/pandas/core/accessor.py
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ashlr-plugin@1.37.1.
See all versions of ashlr-plugin for other recorded verdicts.
- Review the evidence and your use of ashlr-plugin@1.37.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.