registry / autodev-cli / 1.4.4

autodev-cli@1.4.4

AutoAIDev CLI — autonomous AI task loop with VS Code / Cursor launcher

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 836 KB of source, external domains: api.github.com, astral.sh, discord.com, github.com

Source & flagged code

4 flagged

out/providers/opencodeSdkProvider.jsView file

Lines 82-122javascript

82// ---------------------------------------------------------------------------

83let _sdkCache = null;

84// Walk up from __dirname to find @opencode-ai/sdk/dist/index.js.

85// We import by absolute path to bypass the exports map resolution entirely —

86// bare specifier import('@opencode-ai/sdk') uses CJS resolution in a CJS bundle

87// and fails because the package only defines an "import" condition (no "require").

88function _findSdkEntryPath() {

89 let dir = __dirname;

90 // eslint-disable-next-line no-constant-condition

91 while (true) {

92 const candidate = path.join(dir, 'node_modules', '@opencode-ai', 'sdk', 'dist', 'index.js');

93 if (fs.existsSync(candidate)) {

94 return candidate;

95 }

96 const parent = path.dirname(dir);

97 if (parent === dir) {

98 throw new Error('@opencode-ai/sdk not found in any node_modules above ' + __dirname);

99 }

100 dir = parent;

101 }

102}

103// Use new Function() to prevent esbuild from transforming import(path) to require(path).

104// require() cannot load ESM files; a native ESM import() is required.

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/providers/opencodeSdkProvider.jsView on unpkg · L102

105const _dynamicImport = new Function('p', 'return import(p)');

106async function _getSdk() {

107 if (!_sdkCache) {

108 const sdkPath = _findSdkEntryPath();

109 // pathToFileURL handles Windows drive-letter paths (e.g. H:\...) which

110 // Node's ESM loader rejects as unknown URL schemes unless converted to file://

111 const sdkUrl = (0, url_1.pathToFileURL)(sdkPath).href;

112 _sdkCache = (await _dynamicImport(sdkUrl));

113 }

114 return _sdkCache;

115}

116// ---------------------------------------------------------------------------

117// Free-port finder — tries ports starting at BASE_PORT, increments until one

118// is not bound, so multiple VS Code instances on the same machine each get

119// their own port.

120// ---------------------------------------------------------------------------

121const BASE_PORT = 4096;

122const MAX_PORT = 4200;

bin/autodev-ping.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Quick WS-handshake verifier. Reads wsUrl from <cwd>/.autodev/settings.json

3// (or .vscode/autodev.json), opens a WebSocket connection, waits for the

4// server's first frame (or a 2s grace period), then exits 0 on success.

6const fs = require('fs');

7const path = require('path');

out/rdp/bridge.jsView file

Lines 37-77javascript

37 o["default"] = v;

38});

39var __importStar = (this && this.__importStar) || (function () {

40 var ownKeys = function(o) {

41 ownKeys =

out/providers/copilotSdkProvider.jsView file

Lines 46-86javascript

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.setCopilotSettingsToken = setCopilotSettingsToken;

50exports.clearCopilotAuthCache = clearCopilotAuthCache;

51exports.copilotNpmRoot = copilotNpmRoot;

52exports.clearCopilotSdkCache

Source & flagged code

4 flagged · loading source

out/providers/opencodeSdkProvider.jsView file

102} L103: // Use new Function() to prevent esbuild from transforming import(path) to require(path). L104: // require() cannot load ESM files; a native ESM import() is required.

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/providers/opencodeSdkProvider.jsView on unpkg · L102

bin/autodev-ping.jsView file

5L6: const fs = require('fs'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/autodev-ping.jsView on unpkg · L5

out/rdp/bridge.jsView file

57exports.RdpBridge = void 0; L58: const net = __importStar(require("net")); L59: const crypto = __importStar(require("crypto")); ... L73: // X.224 Data TPDU: LI(1)=2, code(1)=0xF0, EOT(1)=0x80 L74: const header = Buffer.from([0x02, constants_1.X224_TPDU_DATA, 0x80]); L75: return Buffer.concat([header, payload]); ... L185: } L186: // ConnectGCCPDU body: choice(1) + conference-name(5) + optFlags(2) + "Duca"(4) L187: // + perLen(clientData) + clientData

Low

Weak Crypto

Package source references weak cryptographic algorithms.

out/rdp/bridge.jsView on unpkg · L57

out/providers/copilotSdkProvider.jsView file

66function _copilotNpmRoot() { L67: if (process.platform === 'win32') { L68: return path.join(os.homedir(), 'AppData', 'Roaming', 'npm', 'node_modules', '@github', 'copilot'); L69: } ... L90: async function _fetchCopilotUser(token) { L91: const res = await fetch('https://api.github.com/copilot_internal/user', { L92: headers: { 'Authorization': 'token ' + token, 'User-Agent': 'GitHubCopilotCLI/1.0' }, ... L96: } L97: return res.json(); L98: } ... L105: const envToken = _settingsToken || L106: process.env['COPILOT_GITHUB_TOKEN'] ||

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

out/providers/copilotSdkProvider.jsView on unpkg · L66

Findings

1 High4 Medium7 Low

HighSandbox Evasion Gated Capabilityout/providers/copilotSdkProvider.js

MediumDynamic Requirebin/autodev-ping.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalout/providers/opencodeSdkProvider.js

LowWeak Cryptoout/rdp/bridge.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

out/providers/opencodeSdkProvider.jsView file

Lines 82-122javascript

82// ---------------------------------------------------------------------------

83let _sdkCache = null;

84// Walk up from __dirname to find @opencode-ai/sdk/dist/index.js.

85// We import by absolute path to bypass the exports map resolution entirely —

86// bare specifier import('@opencode-ai/sdk') uses CJS resolution in a CJS bundle

87// and fails because the package only defines an "import" condition (no "require").

88function _findSdkEntryPath() {

89 let dir = __dirname;

90 // eslint-disable-next-line no-constant-condition

91 while (true) {

92 const candidate = path.join(dir, 'node_modules', '@opencode-ai', 'sdk', 'dist', 'index.js');

93 if (fs.existsSync(candidate)) {

94 return candidate;

95 }

96 const parent = path.dirname(dir);

97 if (parent === dir) {

98 throw new Error('@opencode-ai/sdk not found in any node_modules above ' + __dirname);

99 }

100 dir = parent;

101 }

102}

103// Use new Function() to prevent esbuild from transforming import(path) to require(path).

104// require() cannot load ESM files; a native ESM import() is required.

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/providers/opencodeSdkProvider.jsView on unpkg · L102

105const _dynamicImport = new Function('p', 'return import(p)');

106async function _getSdk() {

107 if (!_sdkCache) {

108 const sdkPath = _findSdkEntryPath();

109 // pathToFileURL handles Windows drive-letter paths (e.g. H:\...) which

110 // Node's ESM loader rejects as unknown URL schemes unless converted to file://

111 const sdkUrl = (0, url_1.pathToFileURL)(sdkPath).href;

112 _sdkCache = (await _dynamicImport(sdkUrl));

113 }

114 return _sdkCache;

115}

116// ---------------------------------------------------------------------------

117// Free-port finder — tries ports starting at BASE_PORT, increments until one

118// is not bound, so multiple VS Code instances on the same machine each get

119// their own port.

120// ---------------------------------------------------------------------------

121const BASE_PORT = 4096;

122const MAX_PORT = 4200;

bin/autodev-ping.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Quick WS-handshake verifier. Reads wsUrl from <cwd>/.autodev/settings.json

3// (or .vscode/autodev.json), opens a WebSocket connection, waits for the

4// server's first frame (or a 2s grace period), then exits 0 on success.

6const fs = require('fs');

7const path = require('path');

out/rdp/bridge.jsView file

Lines 37-77javascript

37 o["default"] = v;

38});

39var __importStar = (this && this.__importStar) || (function () {

40 var ownKeys = function(o) {

41 ownKeys =

out/providers/copilotSdkProvider.jsView file

Lines 46-86javascript

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.setCopilotSettingsToken = setCopilotSettingsToken;

50exports.clearCopilotAuthCache = clearCopilotAuthCache;

51exports.copilotNpmRoot = copilotNpmRoot;

52exports.clearCopilotSdkCache