registry / buildwithnexus / 0.12.4

buildwithnexus@0.12.4

Fast, local-first AI coding agent for the terminal, written in Rust. Works with hosted APIs (Anthropic, OpenAI) and local models (Ollama).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 11.6 KB of source, external domains: buildwithnexus.dev, github.com

Source & flagged code

2 flagged

bin/buildwithnexus.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3// Thin launcher: resolve the platform binary and hand off with stdio inherited

4// so the alternate-screen TUI works exactly as if it were invoked directly.

5// Deliberately boring — no install scripts, no network, no dynamic code. The

6// binary itself handles update checks.

7const path = require('path');

8const { spawnSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/buildwithnexus.jsView on unpkg · L6

9const { existing, platformPackage, target } = require('../scripts/resolve-binary.js');

11// Blocking y/N prompt on the controlling TTY — the launcher is synchronous by

12// design, so a readline event loop would be more machinery than the question.

13// Node keeps a TTY stdin (fd 0) in non-blocking mode, so readSync(0) throws

14// EAGAIN on macOS instead of waiting — a freshly opened /dev/tty fd blocks

15// like the question needs. Windows has no /dev/tty; there fd 0 does block.

16function askConsent() {

17 const fs = require('fs');

18 process.stderr.write(

19 `buildwithnexus: no prebuilt binary is installed for ${process.platform} ${process.arch}.\n` +

20 ' Download the checksum-verified binary from the GitHub release now? [y/N] '

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/buildwithnexus.jsView on unpkg · L7

21 );

22 let fd = 0;

23 try {

24 fd = fs.openSync('/dev/tty', 'r');

25 } catch {}

26 try {

27 const buf = Buffer.alloc(64);

Source & flagged code

2 flagged · loading source

bin/buildwithnexus.jsView file

7const path = require('path'); L8: const { spawnSync } = require('child_process'); L9: const { existing, platformPackage, target } = require('../scripts/resolve-binary.js'); ... L17: const fs = require('fs'); L18: process.stderr.write( L19: `buildwithnexus: no prebuilt binary is installed for ${process.platform} ${process.arch}.\n` + L20: ' Download the checksum-verified binary from the GitHub release now? [y/N] ' ... L28: const n = fs.readSync(fd, buf, 0, 64, null); L29: return /^y(es)?$/i.test(buf.toString('utf8', 0, n).trim()); L30: } catch { ... L48: flagIdx !== -1 || L49: process.env.BWN_ALLOW_BOOTSTRAP === '1' ||

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/buildwithnexus.jsView on unpkg · L7

6// binary itself handles update checks. L7: const path = require('path'); L8: const { spawnSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/buildwithnexus.jsView on unpkg · L6

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/buildwithnexus.js

MediumDynamic Requirebin/buildwithnexus.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/buildwithnexus.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3// Thin launcher: resolve the platform binary and hand off with stdio inherited

4// so the alternate-screen TUI works exactly as if it were invoked directly.

5// Deliberately boring — no install scripts, no network, no dynamic code. The

6// binary itself handles update checks.

7const path = require('path');

8const { spawnSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/buildwithnexus.jsView on unpkg · L6

9const { existing, platformPackage, target } = require('../scripts/resolve-binary.js');

11// Blocking y/N prompt on the controlling TTY — the launcher is synchronous by

12// design, so a readline event loop would be more machinery than the question.

13// Node keeps a TTY stdin (fd 0) in non-blocking mode, so readSync(0) throws

14// EAGAIN on macOS instead of waiting — a freshly opened /dev/tty fd blocks

15// like the question needs. Windows has no /dev/tty; there fd 0 does block.

16function askConsent() {

17 const fs = require('fs');

18 process.stderr.write(

19 `buildwithnexus: no prebuilt binary is installed for ${process.platform} ${process.arch}.\n` +

20 ' Download the checksum-verified binary from the GitHub release now? [y/N] '

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/buildwithnexus.jsView on unpkg · L7

21 );

22 let fd = 0;

23 try {

24 fd = fs.openSync('/dev/tty', 'r');

25 } catch {}

26 try {

27 const buf = Buffer.alloc(64);