registry / base_parts_ai / 1.0.55

base_parts_ai@1.0.55

jaskle base_parts_ai

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 64.1 KB of source, external domains: jai.jaskle.cn, jdwfiles.oss-cn-hangzhou.aliyuncs.com, registry.npmmirror.com

Source & flagged code

5 flagged

bin/jcx.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3'use strict';

5var fs = require('fs');

6var os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/jcx.jsView on unpkg · L4

7var path = require('path');

8var { execSync } = require('child_process');

9var { Command } = require('commander');

High

Child Process

Package source references child process execution.

bin/jcx.jsView on unpkg · L7

11/**

12 * 构建 Codex 配置路径，并确保 ~/.codex 目录存在

13 * @param {object} cmd commander 解析出的选项

14 * @returns {object}

15 */

16function getBuildCfg(cmd) {

17 var buildCfg = {};

18 buildCfg.details = cmd.details;

20 // 从 npm 全局目录下的 @openai/codex/package.json 提取 Codex 版本号

21 // 该版本号用于后续和渠道 cxVersionList 做一致性校验

22 try {

23 var npmRootG = execSync('npm root -g', { encoding: 'utf8' }).trim();

24 var codexPkgPath = path.join(npmRootG, '@openai', 'codex', 'package.json');

25 var codexPkg = JSON.parse(fs.readFileSync(codexPkgPath, 'utf8'));

26 buildCfg.codexVersion = codexPkg.version || '';

27 } catch (e) {

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node 'use strict'; var fs = require('fs'); var os = require('os'); var path = require('path'); var { execsync } = require('child_process'); var { command } = require('commander'); function getbuildcfg(cmd) { var buildcfg = {}; buildcfg.details = cmd.details; try { var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim(); var codexpkgpath = path.jo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/jcx.jsView on unpkg

lib/ai_utils.jsView file

Lines 1-29javascript

1'use strict';

3/**

4 * Claude 配置工具函数

5 * 供 setapi_cc.js、setapi_cx.js 等命令模块共享使用

6 */

8var fs = require('fs');

9var path =

Source & flagged code

5 flagged · loading source

bin/jcx.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code