registry / chaching / 1.10.1

chaching@1.10.1

Local multi-provider AI token spend dashboard for Claude Code, Codex, OpenCode, and Cursor.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 1.50 MB of source, external domains: api.cursor.com, datatracker.ietf.org, my.site, npmjs.com, svelte.dev, www.w3.org

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 5973-6024javascript

5973async function writePng2(model, flags) {

5974 const outPath = flags.pngPath ?? `./chaching-wrapped-${model.month}.png`;

5975 lastPngPath2 = outPath;

5976 let renderWrappedPng2;

5977 try {

5978 ({ renderWrappedPng: renderWrappedPng2 } = await Promise.resolve().then(() => (init_render_png2(), render_png_exports2)));

5979 } catch (err) {

5980 failPng2(err);

5981 }

5982 try {

5983 const png = await renderWrappedPng2(model);

5984 const { writeFile: writeFile2 } = await import("fs/promises");

5985 await writeFile2(outPath, png);

5986 } catch (err) {

5987 failPng2(err);

5988 }

5989}

5990function failPng2(err) {

5991 const msg = err instanceof Error ? err.message : String(err);

5992 const code = err instanceof Error ? err.code : void 0;

5993 const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/.test(msg);

5994 process.stderr.write(

5995 "chaching wrapped: PNG export requires the brand renderer.\n" + (missingDep ? "Your install came without the PNG renderer dependencies. Install them with:\n npm i -g satori @resvg/resvg-js\n(or reinstall chaching to pull the optional renderer).\n" : `PNG render failed: ${msg}

5996`)

5997 );

5998 process.exit(1);

5999}

6000

6001// src/cli/commands/serve.ts

6002init_personality();

6003init_theme();

6004import { createServer } from "net";

6005import { spawn } from "child_process";

6006import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5993

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L6004

6007import { readFile as readFile2 } from "fs/promises";

6008import { homedir as homedir4, platform } from "os";

6009import { dirname as dirname6, join as join9 } from "path";

6010import { fileURLToPath as fileURLToPath5 } from "url";

6011

6012// src/lib/core/base-path.js

6013function normalizeBasePath(raw) {

6014 if (raw == null) return "";

6015 const trimmed = raw.trim();

6016 if (trimmed === "" || trimmed === "/") return "";

6017 const inner = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");

6018 return inner === "" ? "" : `/${inner}`;

6019}

6020

6021// src/cli/commands/serve.ts

6022function configPath() {

6023 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join9(homedir4(), ".config");

6024 return join9(configHome, "chaching", "config.json");

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

Source & flagged code

5 flagged · loading source

dist/cli/index.jsView file

6004import { createServer } from "net"; L6005: import { spawn } from "child_process"; L6006: import { existsSync as existsSync5 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L6004

5993const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND... L5994: process.stderr.write( L5995: "chaching wrapped: PNG export requires the brand renderer.\n" + (missingDep ? "Your install came without the PNG renderer dependencies. Install them with:\n npm i -g satori @resvg... ... L6003: init_theme(); L6004: import { createServer } from "net"; L6005: import { spawn } from "child_process"; L6006: import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5993

bin/chaching.jsView file

26if (existsSync(cliEntry)) { L27: await import(cliEntry); L28: // One-shot commands must be force-exited: the bundled graph (Ink/clack touch

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/chaching.jsView on unpkg · L26

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

Findings

4 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCommand Output Exfiltrationdist/cli/index.js

HighShips High Entropy Blobstatic/fonts/space-grotesk-latin-700-normal.woff2

MediumDynamic Requirebin/chaching.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbuild/client/robots.txt.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 5973-6024javascript

5973async function writePng2(model, flags) {

5974 const outPath = flags.pngPath ?? `./chaching-wrapped-${model.month}.png`;

5975 lastPngPath2 = outPath;

5976 let renderWrappedPng2;

5977 try {

5978 ({ renderWrappedPng: renderWrappedPng2 } = await Promise.resolve().then(() => (init_render_png2(), render_png_exports2)));

5979 } catch (err) {

5980 failPng2(err);

5981 }

5982 try {

5983 const png = await renderWrappedPng2(model);

5984 const { writeFile: writeFile2 } = await import("fs/promises");

5985 await writeFile2(outPath, png);

5986 } catch (err) {

5987 failPng2(err);

5988 }

5989}

5990function failPng2(err) {

5991 const msg = err instanceof Error ? err.message : String(err);

5992 const code = err instanceof Error ? err.code : void 0;

5993 const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/.test(msg);

5994 process.stderr.write(

5996`)

5997 );

5998 process.exit(1);

5999}

6000

6001// src/cli/commands/serve.ts

6002init_personality();

6003init_theme();

6004import { createServer } from "net";

6005import { spawn } from "child_process";

6006import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5993

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L6004

6007import { readFile as readFile2 } from "fs/promises";

6008import { homedir as homedir4, platform } from "os";

6009import { dirname as dirname6, join as join9 } from "path";

6010import { fileURLToPath as fileURLToPath5 } from "url";

6011

6012// src/lib/core/base-path.js

6013function normalizeBasePath(raw) {

6014 if (raw == null) return "";

6015 const trimmed = raw.trim();

6016 if (trimmed === "" || trimmed === "/") return "";

6017 const inner = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");

6018 return inner === "" ? "" : `/${inner}`;

6019}

6020

6021// src/cli/commands/serve.ts

6022function configPath() {

6023 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join9(homedir4(), ".config");

6024 return join9(configHome, "chaching", "config.json");

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg