registry / cascade-ai / 0.12.20

cascade-ai@0.12.20

Multi-tier AI orchestration CLI — T1/T2/T3 hierarchical agent system

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 2.78 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.groq.com, api.search.brave.com, api.tavily.com, app.posthog.com, express-rate-limit.github.io, generativelanguage.googleapis.com, gitlab.com, lite.duckduckgo.com, openrouter.ai, raw.githubusercontent.com, react.dev, reactflow.dev, www.w3.org

Oversized source lightweight scan

dist/desktop-core.cjs8.30 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStrings127.0.0.1express-rate-limit.github.io

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-36javascript

1import EventEmitter from 'events';

2import crypto, { randomUUID, timingSafeEqual } from 'crypto';

3import { glob } from 'glob';

4import Anthropic from '@anthropic-ai/sdk';

5import OpenAI, { AzureOpenAI } from 'openai';

6import { GoogleGenAI, HarmBlockThreshold, HarmCategory } from '@google/genai';

7import dns from 'dns';

8import http, { createServer } from 'http';

9import https from 'https';

10import zlib from 'zlib';

11import { Readable } from 'stream';

12import fs4 from 'fs/promises';

13import path18 from 'path';

14import os4 from 'os';

15import * as ignoreFactory from 'ignore';

16import ignoreFactory__default from 'ignore';

17import { exec, execFile, execSync } from 'child_process';

18import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

19import fs17 from 'fs';

20import { simpleGit } from 'simple-git';

21import PDFDocument from 'pdfkit';

22import dns2 from 'dns/promises';

23import net from 'net';

24import { Client } from '@modelcontextprotocol/sdk/client/index.js';

25import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';

26import { z } from 'zod';

27import { Worker } from 'worker_threads';

28import Database from 'better-sqlite3';

29import { fileURLToPath } from 'url';

30import express from 'express';

31import rateLimit from 'express-rate-limit';

32import bcrypt from 'bcryptjs';

33import { Server } from 'socket.io';

34import parser from 'socket.io-msgpack-parser';

35import jwt from 'jsonwebtoken';

36import cron from 'node-cron';

Lines 3935-3977javascript

3935 this.peerBus.publish = (fromId, subtaskId, output, status) => {

3936 if (fromId === this.id) cleanup();

3937 this.peerBus.publish = origPublish;

3938 origPublish(fromId, subtaskId, output, status);

3939 };

dist/index.cjsView file

Lines 1-28javascript

1'use strict';

3var EventEmitter = require('events');

4var crypto = require('crypto');

5var glob = require('glob');

6var Anthropic = require(

completions/cascade.fishView file

•path = completions/cascade.fish kind = build_helper sizeBytes = 1023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/cascade.fishView on unpkg

dist/desktop-core.cjsView file

•path = dist/desktop-core.cjs kind = oversized_source_file sizeBytes = 8700173 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/desktop-core.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

16import ignoreFactory__default from 'ignore'; L17: import { exec, execFile, execSync } from 'child_process'; L18: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

3957const { promisify: promisify4 } = await import('util'); L3958: const execAsync2 = promisify4(exec2); L3959: for (const artifactPath of artifactPaths) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3957

3955const issues = []; L3956: const { exec: exec2 } = await import('child_process'); L3957: const { promisify: promisify4 } = await import('util');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3955

dist/index.cjsView file

8Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L8: var genai = require('@google/genai'); L9: var dns = require('dns'); L10: var http = require('http'); ... L17: var ignoreFactory = require('ignore'); L18: var child_process = require('child_process'); L19: var util = require('util'); ... L595: } L596: const data = await resp.json(); L597: if (!Array.isArray(data?.data)) { ... L670: type: "image", L671: source: { type: "base64", media_type: img.mimeType, data: img.data } L672: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L8

completions/cascade.fishView file

•path = completions/cascade.fish kind = build_helper sizeBytes = 1023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/cascade.fishView on unpkg

dist/desktop-core.cjsView file

•path = dist/desktop-core.cjs kind = oversized_source_file sizeBytes = 8700173 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/desktop-core.cjsView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCross File Remote Execution Contextdist/index.cjs

HighOversized Source Filedist/desktop-core.cjs

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercompletions/cascade.fish

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-36javascript

1import EventEmitter from 'events';

2import crypto, { randomUUID, timingSafeEqual } from 'crypto';

3import { glob } from 'glob';

4import Anthropic from '@anthropic-ai/sdk';

5import OpenAI, { AzureOpenAI } from 'openai';

6import { GoogleGenAI, HarmBlockThreshold, HarmCategory } from '@google/genai';

7import dns from 'dns';

8import http, { createServer } from 'http';

9import https from 'https';

10import zlib from 'zlib';

11import { Readable } from 'stream';

12import fs4 from 'fs/promises';

13import path18 from 'path';

14import os4 from 'os';

15import * as ignoreFactory from 'ignore';

16import ignoreFactory__default from 'ignore';

17import { exec, execFile, execSync } from 'child_process';

18import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

19import fs17 from 'fs';

20import { simpleGit } from 'simple-git';

21import PDFDocument from 'pdfkit';

22import dns2 from 'dns/promises';

23import net from 'net';

24import { Client } from '@modelcontextprotocol/sdk/client/index.js';

25import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';

26import { z } from 'zod';

27import { Worker } from 'worker_threads';

28import Database from 'better-sqlite3';

29import { fileURLToPath } from 'url';

30import express from 'express';

31import rateLimit from 'express-rate-limit';

32import bcrypt from 'bcryptjs';

33import { Server } from 'socket.io';

34import parser from 'socket.io-msgpack-parser';

35import jwt from 'jsonwebtoken';

36import cron from 'node-cron';

Lines 3935-3977javascript

3935 this.peerBus.publish = (fromId, subtaskId, output, status) => {

3936 if (fromId === this.id) cleanup();

3937 this.peerBus.publish = origPublish;

3938 origPublish(fromId, subtaskId, output, status);

3939 };

dist/index.cjsView file

Lines 1-28javascript

1'use strict';

3var EventEmitter = require('events');

4var crypto = require('crypto');

5var glob = require('glob');

6var Anthropic = require(

completions/cascade.fishView file

•path = completions/cascade.fish kind = build_helper sizeBytes = 1023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/cascade.fishView on unpkg

dist/desktop-core.cjsView file

•path = dist/desktop-core.cjs kind = oversized_source_file sizeBytes = 8700173 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/desktop-core.cjsView on unpkg