registry / baldart / 5.3.2

baldart@5.3.2

⚠ Under review

Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 820 KB of source, external domains: biomejs.dev, github.com, pypi.org, registry.npmjs.org

Source & flagged code

8 flagged

framework/scripts/analyze-session-tokens.jsView file

Lines 338-378javascript

338 padL(fmtDuration(runWallMs), W[2]),

339 padL(fmtTokens(totals.output), W[3]),

340 padL(fmtTokens(totals.fresh_input), W[4]),

341 padL(fmtTokens(totals.cache_creation), W[5]),

342 padL(fmtTokens(totals.cache_read), W[6]),

343 padL(fmtTokens(totals.cost_units), W[7]),

344 padL('100%', W[8]),

345 ].join(' | ')

346);

347lines.push('');

348lines.push('> wall(sum) is the sum of per-agent spans and reflects ACTIVE compute time; the');

349lines.push('> run wall-clock is the orchestrator first→last span and INCLUDES human idle gaps.');

350lines.push('> Subagents may run in parallel, so wall(sum) can exceed the run wall-clock.');

351lines.push('> cache_read tokens are ~10% the cost of fresh input — kept separate on purpose.');

352if (unmatchedFiles > 0) {

353 lines.push('>');

354 lines.push(`> ⚠ ${unmatchedFiles} subagent file(s) could not be mapped to a role (bucketed as "unknown").`);

355}

356if (missingNested > 0) {

357 lines.push('>');

358 lines.push(

359 `> ⚠ team-mode caveat: ${missingNested} Agent spawn(s) in the main transcript have no local`

360 );

High

Child Process

Package source references child process execution.

framework/scripts/analyze-session-tokens.jsView on unpkg · L358

361 lines.push(

362 `> subagent file (likely background / nested orchestrators in separate sessions) — their`

363 );

364 lines.push(`> tokens are NOT included in these totals. Sequential-mode runs are fully accurate.`);

365}

366lines.push('');

367

368// ---- emit ------------------------------------------------------------------

369

370const sessionsDir = path.join(outDir, 'sessions');

371try {

372 fs.mkdirSync(sessionsDir, { recursive: true });

373 fs.writeFileSync(path.join(sessionsDir, `${runId}.md`), lines.join('\n'));

374} catch (err) {

375 skip(`could not write summary: ${err.message}`);

376}

377

378// human summary to stdout

bin/baldart.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3// Suppress ExperimentalWarning noise from Node/npm internals (v3.25.0+).

4// On Node 22+ npm emits a CommonJS/ESM ExperimentalWarning on every spawn —

5// not actionable for our users, repeated on every invocation, illegible.

6// Setting NODE_NO_WARNINGS in env BEFORE any spawn propagates to all

7// child processes we launch (git, npx, etc). Cannot silence the warning

8// emitted by `npx` itself BEFORE our code loads — for that, the

9// recommended install is `npm i -g baldart` (then `baldart` direct).

10// Escape hatch: BALDART_VERBOSE_WARNINGS=1 keeps them visible.

11if (process.env.BALDART_VERBOSE_WARNINGS

src/utils/routine-adapters/cron.jsView file

Lines 1-27javascript

1const fs = require('fs');

2const path = require('path');

4/**

5 * Local cron adapter.

6 *

7 * Generates `scripts/routines/<name>.sh` (a self-contained wrapper) and prints

8 * the exact crontab line the user must install. Does NOT touch the user's

src/utils/overlay-merger.jsView file

Lines 97-137javascript

97 * truthful (it tracks the version the overlay was last reconciled against)

98 * without ever masking real drift: when the base content HAS changed the sha

99 * differs, so we leave the stale pin alone and it remains a legitimate

100 * "review me" signal for `overlay drift` / `status` / `doctor`.

101 *

src/utils/i18n-gate.jsView file

Lines 144-184javascript

144 return fs.existsSync(path.join(cwd, FLAT_CONFIG)) || fs.existsSync(path.join(cwd, LEGACY_CONFIG));

145}

146

147/** Write the era-correct standalone config — only when absent. Never overwrites. */

148function writeConfig(cwd = process.cwd()) {

framework/.claude/hooks/agent-discovery-info.shView file

•path = framework/.claude/hooks/agent-discovery-info.sh kind = payload_in_excluded_dir sizeBytes = 7152 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

framework/.claude/hooks/agent-discovery-info.shView on unpkg

•path = framework/.claude/hooks/agent-discovery-info.sh kind = build_helper sizeBytes = 7152 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/.claude/hooks/agent-discovery-info.shView on unpkg

Source & flagged code

8 flagged · loading source

framework/scripts/analyze-session-tokens.jsView file

358lines.push( L359: `> ⚠ team-mode caveat: ${missingNested} Agent spawn(s) in the main transcript have no local` L360: );

High

Child Process

Package source references child process execution.

framework/scripts/analyze-session-tokens.jsView on unpkg · L358

bin/baldart.jsView file

14L15: const { Command } = require('commander'); L16: const chalk = require('chalk');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/baldart.jsView on unpkg · L14

src/utils/routine-adapters/cron.jsView file

7* Generates `scripts/routines/<name>.sh` (a self-contained wrapper) and prints L8: * the exact crontab line the user must install. Does NOT touch the user's L9: * crontab directly — that would be too invasive. ... L13: class CronAdapter { L14: constructor(cwd = process.cwd()) { L15: this.cwd = cwd; ... L85: return `#!/usr/bin/env bash L86: # Generated by BALDART (v${require('../../../package.json').version}) — npx baldart routines L87: # Routine: ${spec.name}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/routine-adapters/cron.jsView on unpkg · L7

src/utils/overlay-merger.jsView file

117contains invisible/control Unicode U+FEFF (zero width no-break space) const m = content.match(/^(<U+FEFF>?\s*)---\n([\s\S]*?)\n---(\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

src/utils/overlay-merger.jsView on unpkg · L117

•Trigger-reachable chain: manifest.bin -> bin/baldart.js -> src/commands/overlay.js -> src/utils/overlay-merger.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/utils/overlay-merger.jsView on unpkg

src/utils/i18n-gate.jsView file

164function installDeps(cwd = process.cwd()) { L165: execSync(`npm install -D ${depsFor(cwd).join(' ')}`, { cwd, stdio: 'ignore' }); L166: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/i18n-gate.jsView on unpkg · L164

framework/.claude/hooks/agent-discovery-info.shView file

•path = framework/.claude/hooks/agent-discovery-info.sh kind = payload_in_excluded_dir sizeBytes = 7152 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

framework/.claude/hooks/agent-discovery-info.shView on unpkg

•path = framework/.claude/hooks/agent-discovery-info.sh kind = build_helper sizeBytes = 7152 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

framework/.claude/hooks/agent-discovery-info.shView on unpkg

Findings

2 Critical4 High6 Medium5 Low

CriticalTrojan Source Unicodesrc/utils/overlay-merger.js

CriticalTrigger Reachable Dangerous Capabilitysrc/utils/overlay-merger.js

HighChild Processframework/scripts/analyze-session-tokens.js

HighShell

HighRuntime Package Installsrc/utils/i18n-gate.js

HighPayload In Excluded Dirframework/.claude/hooks/agent-discovery-info.sh

MediumDynamic Requirebin/baldart.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/utils/routine-adapters/cron.js

MediumShips Build Helperframework/.claude/hooks/agent-discovery-info.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings