registry / autodev-cli / 1.4.63

autodev-cli@1.4.63

AutoAIDev CLI — autonomous AI task loop with VS Code / Cursor launcher

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 1.01 MB of source, external domains: api.github.com, astral.sh, discord.com, github.com

Source & flagged code

5 flagged

out/providers/opencodeSdkProvider.jsView file

Lines 108-148javascript

108// ---------------------------------------------------------------------------

109let _sdkCache = null;

110// Walk up from __dirname to find @opencode-ai/sdk/dist/index.js.

111// We import by absolute path to bypass the exports map resolution entirely —

112// bare specifier import('@opencode-ai/sdk') uses CJS resolution in a CJS bundle

113// and fails because the package only defines an "import" condition (no "require").

114function _findSdkEntryPath() {

115 let dir = __dirname;

116 // eslint-disable-next-line no-constant-condition

117 while (true) {

118 const candidate = path.join(dir, 'node_modules', '@opencode-ai', 'sdk', 'dist', 'index.js');

119 if (fs.existsSync(candidate)) {

120 return candidate;

121 }

122 const parent = path.dirname(dir);

123 if (parent === dir) {

124 throw new Error('@opencode-ai/sdk not found in any node_modules above ' + __dirname);

125 }

126 dir = parent;

127 }

128}

129// Use new Function() to prevent esbuild from transforming import(path) to require(path).

130// require() cannot load ESM files; a native ESM import() is required.

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/providers/opencodeSdkProvider.jsView on unpkg · L128

131const _dynamicImport = new Function('p', 'return import(p)');

132async function _getSdk() {

133 if (!_sdkCache) {

134 const sdkPath = _findSdkEntryPath();

135 // pathToFileURL handles Windows drive-letter paths (e.g. H:\...) which

136 // Node's ESM loader rejects as unknown URL schemes unless converted to file://

137 const sdkUrl = (0, url_1.pathToFileURL)(sdkPath).href;

138 _sdkCache = (await _dynamicImport(sdkUrl));

139 }

140 return _sdkCache;

141}

142// ---------------------------------------------------------------------------

143// Free-port finder — tries ports starting at BASE_PORT, increments until one

144// is not bound, so multiple VS Code instances on the same machine each get

145// their own port.

146// ---------------------------------------------------------------------------

147const BASE_PORT = 4096;

148const MAX_PORT = 4200;

bin/autodev-ping.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Quick WS-handshake verifier. Reads wsUrl from <cwd>/.autodev/settings.json

3// (or .vscode/autodev.json), opens a WebSocket connection, waits for the

4// server's first frame (or a 2s grace period), then exits 0 on success.

6const fs = require('fs');

7const path

out/rdp/bridge.jsView file

Lines 37-77javascript

37 o["default"] = v;

38});

39var __importStar = (this && this.__importStar) || (function () {

40 var ownKeys

out/providers/copilotSdkProvider.jsView file

Lines 48-88javascript

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.setCopilotSettingsToken = setCopilotSettingsToken;

50exports.clearCopilotAuthCache = clearCopilotAuthCache;

51exports.copilotNpmRoot = copilotNpmRoot;

out/commands/mcpOperate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = autodev-cli@1.4.62 matchedIdentity = npm:YXV0b2Rldi1jbGk:1.4.62 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/commands/mcpOperate.jsView on unpkg

Source & flagged code

5 flagged · loading source

out/providers/opencodeSdkProvider.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code