registry / calibra / 1.0.10

calibra@1.0.10

Calibra — Claude Code model routing

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 206 KB of source, external domains: api.openai.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-29json

2 "name": "calibra",

3 "version": "1.0.10",

4 "description": "Calibra — Claude Code model routing",

5 "license": "MIT",

6 "private": false,

7 "preferGlobal": true,

8 "scripts": {

9 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "preuninstall": "node scripts/uninstall.js"

11 },

12 "bin": {

13 "calibra": "src/cli.js"

14 },

15 "files": [

16 "src/",

17 "scripts/",

18 "tools/",

19 "README.md",

20 "LICENSE"

21 ],

22 "dependencies": {

23 "@cspell/dict-tr-tr": "^3.0.6",

24 "cspell-lib": "^6.31.3",

25 "onnxruntime-node": "^1.20.1"

26 },

27 "keywords": [

28 "claude",

29 "claude-code",

scripts/install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

tools/relabel_by_rubric.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2'use strict';

4// relabel_by_rubric.js — apply the deterministic bright-line RUBRIC (ruleClassify,

5// NOT the ML) to a .jsonl, emitting a rubric-tier per row. Measurement transform

6// only: originals are never modified, output is for REPORTING (never fed to fit).

7//

8// Usage: node tools/relabel_by_rubric.js <in.jsonl> [<in2.jsonl> ...]

9// writes <name>_rubric.jsonl beside each input and prints an agreement report.

10//

src/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const { execFileSync } = require('child_process');

5const path = require('path');

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

333const proxyScript = path.join(CORP_DIR, 'codex-proxy.js'); L334: const { execFileSync } = require('child_process'); L335:

High

Child Process

Package source references child process execution.

scripts/install.jsView on unpkg · L333

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install.js

HighInstall Named Payload Filescripts/install.js

HighRuntime Package Installsrc/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiretools/relabel_by_rubric.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/install.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings