registry / candura / 1.0.1

candura@1.0.1

Cost intelligence for AI coding agents — predict, track, and optimize Claude Code session costs

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 235 KB of source, external domains: 127.0.0.1, candura.candura-telemetry.workers.dev, example.com

Source & flagged code

3 flagged

packages/core/src/repo-indexer.tsView file

Lines 1-21typescript

1import { execSync } from 'node:child_process';

2import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

packages/core/src/repo-indexer.tsView on unpkg · L1

3import { join, extname, basename } from 'node:path';

4import

Source & flagged code

3 flagged · loading source

packages/core/src/repo-indexer.tsView file

1import { execSync } from 'node:child_process'; L2: import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync, readdirSync } from 'node:fs';

High

Child Process

Package source references child process execution.

packages/core/src/repo-indexer.tsView on unpkg · L1

packages/hooks/src/pre-prompt-fast.mjsView file

51// Spawn daemon detached so it survives hook exit L52: const child = spawn('npx', ['tsx', daemonPath], { L53: cwd: join(hookDir, '..', '..', '..'),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/hooks/src/pre-prompt-fast.mjsView on unpkg · L51

setup.shView file

•path = setup.sh kind = build_helper sizeBytes = 4515 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup.shView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processpackages/core/src/repo-indexer.ts

HighShell

HighRuntime Package Installpackages/hooks/src/pre-prompt-fast.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersetup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

packages/hooks/src/pre-prompt-fast.mjsView file

Lines 31-71javascript

31 body: JSON.stringify({

32 prompt,

33 cwd: input.cwd || '',

34 session_id: input.session_id || '',

35 }),

36 signal: AbortSignal.timeout(2000),

37 });

38 if (res.ok) prediction = await res.json();

39} catch { /* daemon unavailable — try to auto-start */ }

41// If daemon is unavailable, try to auto-start it

42if (!prediction) {

43 try {

44 // Auto-start daemon in background

45 const { spawn } = await import('node:child_process');

46 const { dirname } = await import('node:path');

47 const { fileURLToPath } = await import('node:url');

48 const hookDir = dirname(fileURLToPath(import.meta.url));

49 const daemonPath = join(hookDir, '..', '..', 'daemon', 'src', 'index.ts');

51 // Spawn daemon detached so it survives hook exit

52 const child = spawn('npx', ['tsx', daemonPath], {

53 cwd: join(hookDir, '..', '..', '..'),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/hooks/src/pre-prompt-fast.mjsView on unpkg · L51

54 detached: true,

55 stdio: 'ignore',

56 });

57 child.unref();

59 // Wait briefly for daemon to start, then retry once

60 await new Promise(r => setTimeout(r, 1500));

61 try {

62 const res = await fetch(`${DAEMON}/predict`, {

63 method: 'POST',

64 headers: { 'Content-Type': 'application/json' },

65 body: JSON.stringify({

66 prompt,

67 cwd: input.cwd || '',

68 session_id: input.session_id || '',

69 }),

70 signal: AbortSignal.timeout(2000),

71 });