Loading npm security reports…

capix-code@1.4.11: Suspicious npm security report (Warn) | LPM Firewall

registry / capix-code / 1.4.11

capix-code@1.4.11

Capix Code — decentralized AI coding agent with GPU marketplace

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 29.1 KB of source, external domains: api.github.com, github.com, www.capix.network

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "dist/customer/config/",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "compile": "tsc --noEmit",

22 "lint": "eslint src/",

23 "format": "prettier --write .",

24 "format:check": "prettier --check .",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "manifest:validate": "node scripts/validate-manifest.mjs manifest/release-manifest.json",

29 "manifest:build": "node scripts/build-manifest.mjs",

30 "resolve-version": "node scripts/resolve-version.mjs",

31 "prepack": "node scripts/prepare-npm-meta.mjs",

32 "pack:npm-platform": "node scripts/prepare-npm-platform.mjs",

33 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "devDependencies": {

36 "@ai-sdk/provider": "3.0.8",

37 "@eslint/js": "^9.0.0",

38 "@types/node": "^22.0.0",

39 "@vitest/coverage-v8": "^2.1.0",

40 "eslint": "^9.0.0",

41 "husky": "^9.0.0",

42 "lint-staged": "^15.0.0",

43 "prettier": "^3.0.0",

44 "typescript": "^5.7.0",

45 "typescript-eslint": "^8.0.0",

46 "vitest": "^2.1.0",

47 "@capix/runtime-provider": "file:packages/runtime-provider",

48 "@opencode-ai/plugin": "1.17.18",

49 "@opencode-ai/sdk": "1.17.18",

50 "bun": "^1.3.14",

51 "opencode-ai": "1.17.18"

52 },

53 "lint-staged": {

bin/capix-code.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawnSync } = require('node:child_process');

4const { chmodSync, cpSync, existsSync, mkdirSync } = require(

scripts/postinstall.cjs#virtual:normalized:round1View file

58fs.mkdirSync(mcpDir, { recursive: true }); L59: execSync(`npm install capix-mcp@2.1.0`, { cwd: mcpDir, stdio: 'inherit' }); L60: // Create entry point wrapper that shares credentials with capix-code ... L62: fs.writeFileSync(mcpEntry, L63: "#!/usr/bin/env node\nconst { readFileSync, writeFileSync, chmodSync, existsSync } = require(\"node:fs\");\nconst { join } = require(\"node:path\");\nconst { homedir } = require(\"... L64: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.cjs#virtual:normalized:round1View on unpkg · L58

scripts/postinstall.cjsView file

Lines 38-78javascript

38 const customerSrc = path.join(tmpDir, 'customer');

39 if (fs.existsSync(customerSrc)) {

40 for (const dir of ['bin'

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/capix-code.cjsView file

2L3: const { spawnSync } = require('node:child_process'); L4: const { chmodSync, cpSync, existsSync, mkdirSync } = require('node:fs');

High

Child Process

Package source references child process execution.

bin/capix-code.cjsView on unpkg · L2

Findings

5 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/capix-code.cjs

HighShell

HighSame File Env Network Executionscripts/postinstall.cjs#virtual:normalized:round1

HighRuntime Package Installscripts/postinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/assert-customer-brand.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "dist/customer/config/",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "compile": "tsc --noEmit",

22 "lint": "eslint src/",

23 "format": "prettier --write .",

24 "format:check": "prettier --check .",

25 "test": "vitest run",

26 "test:watch": "vitest",

27 "test:coverage": "vitest run --coverage",

28 "manifest:validate": "node scripts/validate-manifest.mjs manifest/release-manifest.json",

29 "manifest:build": "node scripts/build-manifest.mjs",

30 "resolve-version": "node scripts/resolve-version.mjs",

31 "prepack": "node scripts/prepare-npm-meta.mjs",

32 "pack:npm-platform": "node scripts/prepare-npm-platform.mjs",

33 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "devDependencies": {

36 "@ai-sdk/provider": "3.0.8",

37 "@eslint/js": "^9.0.0",

38 "@types/node": "^22.0.0",

39 "@vitest/coverage-v8": "^2.1.0",

40 "eslint": "^9.0.0",

41 "husky": "^9.0.0",

42 "lint-staged": "^15.0.0",

43 "prettier": "^3.0.0",

44 "typescript": "^5.7.0",

45 "typescript-eslint": "^8.0.0",

46 "vitest": "^2.1.0",

47 "@capix/runtime-provider": "file:packages/runtime-provider",

48 "@opencode-ai/plugin": "1.17.18",

49 "@opencode-ai/sdk": "1.17.18",

50 "bun": "^1.3.14",

51 "opencode-ai": "1.17.18"

52 },

53 "lint-staged": {

bin/capix-code.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawnSync } = require('node:child_process');

4const { chmodSync, cpSync, existsSync, mkdirSync } = require(

scripts/postinstall.cjs#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.cjs#virtual:normalized:round1View on unpkg · L58

scripts/postinstall.cjsView file

Lines 38-78javascript

38 const customerSrc = path.join(tmpDir, 'customer');

39 if (fs.existsSync(customerSrc)) {

40 for (const dir of ['bin'

scripts/assert-customer-brand.shView file

•path = scripts/assert-customer-brand.sh kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/assert-customer-brand.shView on unpkg