registry / bazilion / 0.8.0

bazilion@0.8.0

⚠ Under review

Multi-agent runtime CLI — spawn LLM agents, manage profiles/groups/skills, and run the local daemon.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 2.36 MB of source, external domains: 127.0.0.1, ai-gateway.vercel.sh, api.ant-ling.com, api.cerebras.ai, api.firecrawl.dev, api.groq.com, api.mistral.ai, api.moonshot.cn, api.openai.com, api.telegram.org, api.x.ai, bazilion.com, brave.com, fonts.googleapis.com, fonts.gstatic.com, github.com, integrate.api.nvidia.com, json-schema.org, mcp.example.com, open.bigmodel.cn, opencode.ai, openrouter.ai, raw.githubusercontent.com, react.dev, searxng.example.com, spec.openapis.org, stackoverflow.com, t.me, token-plan-ams.xiaomimimo.com, token-plan-cn.xiaomimimo.com, token-plan-sgp.xiaomimimo.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

7 flagged

dist/web/server/assets/SpawnTeamModal-dSN421k_.jsView file

Lines 1-29javascript

1import { t as Button } from "./Button-Dsnw22OF.js";

2import { useState } from "react";

3import { jsx, jsxs } from "react/jsx-runtime";

4//#region src/components/SpawnTeamModal.tsx

5function SpawnTeamModal({ profileGroup, groups, onClose, onSpawned }) {

6 const [groupSlug, setGroupSlug] = useState("");

7 const [userMd, setUserMd] = useState("");

8 const [err, setErr] = useState(null);

9 const [submitting, setSubmitting] = useState(false);

10 async function spawn() {

11 setErr(null);

High

Child Process

Package source references child process execution.

dist/web/server/assets/SpawnTeamModal-dSN421k_.jsView on unpkg · L9

12 if (!groupSlug.trim()) {

13 setErr("target group slug is required");

14 return;

15 }

16 setSubmitting(true);

17 try {

18 const body = { groupSlug: groupSlug.trim() };

19 if (userMd) body.userMd = userMd;

20 const res = await fetch(`/api/profile-groups/${profileGroup.id}/spawn`, {

21 method: "POST",

22 headers: { "content-type": "application/json" },

23 body: JSON.stringify(body)

24 });

25 if (!res.ok) {

26 const e = await res.json().catch(() => null);

27 throw new Error(e?.error ?? res.statusText);

28 }

29 const result = await res.json();

dist/daemon.jsView file

48function checkPathExt(path, options) { L49: var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT; L50: if (!pathext) { ... L121: var core; L122: if (process.platform === "win32" || global.TESTING_WINDOWS) { L123: core = require_windows(); ... L137: } L138: return new Promise(function(resolve4, reject) { L139: isexe(path, options || {}, function(er, is) { ... L184: // windows always checks the cwd first L185: ...isWindows ? [process.cwd()] : [], L186: ...(opt.path || process.env.PATH || /* istanbul ignore next: very unusual */

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/daemon.jsView on unpkg · L48

436parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`]; L437: parsed.command = process.env.comspec || "cmd.exe"; L438: parsed.options.windowsVerbatimArguments = true;

High

Shell

Package source references shell execution.

dist/daemon.jsView on unpkg · L436

14365sourceCode = this.opts.code.process(sourceCode, sch); L14366: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L14367: const validate2 = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/daemon.jsView on unpkg · L14365

dist/web-server.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

3// src/web-server.ts

4import { existsSync } from "fs";

5import { join } from "path";

6import { pathToFileURL } from "url";

dist/worker.jsView file

Lines 33-73javascript

33// ../daemon/src/core/profile/create.ts

34import { mkdirSync as mkdirSync2, writeFileSync } from "fs";

35import { join as join3 } from "path";

37// ../daemon/src/core/skills/discover.ts

38import { existsSync as

dist/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3// src/index.ts

4import { defineCommand as defineCommand23, runCommand, showUsage } from "citty";

6// package.json

7var package_default = {

8 name: "bazilion",

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code