registry / chaching / 1.12.0

chaching@1.12.0

Local multi-provider AI token spend dashboard for Claude Code, Codex, OpenCode, and Cursor.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 1.50 MB of source, external domains: api.cursor.com, datatracker.ietf.org, my.site, npmjs.com, svelte.dev, www.w3.org

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 5959-6010javascript

5959async function writePng2(model, flags) {

5960 const outPath = flags.pngPath ?? `./chaching-wrapped-${model.month}.png`;

5961 lastPngPath2 = outPath;

5962 let renderWrappedPng2;

5963 try {

5964 ({ renderWrappedPng: renderWrappedPng2 } = await Promise.resolve().then(() => (init_render_png2(), render_png_exports2)));

5965 } catch (err) {

5966 failPng2(err);

5967 }

5968 try {

5969 const png = await renderWrappedPng2(model);

5970 const { writeFile: writeFile2 } = await import("fs/promises");

5971 await writeFile2(outPath, png);

5972 } catch (err) {

5973 failPng2(err);

5974 }

5975}

5976function failPng2(err) {

5977 const msg = err instanceof Error ? err.message : String(err);

5978 const code = err instanceof Error ? err.code : void 0;

5979 const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/.test(msg);

5980 process.stderr.write(

5981 "chaching wrapped: PNG export requires the brand renderer.\n" + (missingDep ? "Your install came without the PNG renderer dependencies. Install them with:\n npm i -g satori @resvg/resvg-js\n(or reinstall chaching to pull the optional renderer).\n" : `PNG render failed: ${msg}

5982`)

5983 );

5984 process.exit(1);

5985}

5986

5987// src/cli/commands/serve.ts

5988init_personality();

5989init_theme();

5990import { createServer } from "net";

5991import { spawn } from "child_process";

5992import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5979

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L5990

5993import { readFile as readFile2 } from "fs/promises";

5994import { homedir as homedir4, platform } from "os";

5995import { dirname as dirname6, join as join9 } from "path";

5996import { fileURLToPath as fileURLToPath5 } from "url";

5997

5998// src/lib/core/base-path.js

5999function normalizeBasePath(raw) {

6000 if (raw == null) return "";

6001 const trimmed = raw.trim();

6002 if (trimmed === "" || trimmed === "/") return "";

6003 const inner = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");

6004 return inner === "" ? "" : `/${inner}`;

6005}

6006

6007// src/cli/commands/serve.ts

6008function configPath() {

6009 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join9(homedir4(), ".config");

6010 return join9(configHome, "chaching", "config.json");

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

Source & flagged code

5 flagged · loading source

dist/cli/index.jsView file

5990import { createServer } from "net"; L5991: import { spawn } from "child_process"; L5992: import { existsSync as existsSync5 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L5990

5979const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND... L5980: process.stderr.write( L5981: "chaching wrapped: PNG export requires the brand renderer.\n" + (missingDep ? "Your install came without the PNG renderer dependencies. Install them with:\n npm i -g satori @resvg... ... L5989: init_theme(); L5990: import { createServer } from "net"; L5991: import { spawn } from "child_process"; L5992: import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5979

bin/chaching.jsView file

26if (existsSync(cliEntry)) { L27: await import(cliEntry); L28: // One-shot commands must be force-exited: the bundled graph (Ink/clack touch

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/chaching.jsView on unpkg · L26

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

Findings

4 High5 Medium5 Low

HighChild Processdist/cli/index.js

HighShell

HighCommand Output Exfiltrationdist/cli/index.js

HighShips High Entropy Blobstatic/fonts/space-grotesk-latin-700-normal.woff2

MediumDynamic Requirebin/chaching.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbuild/client/robots.txt.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli/index.jsView file

Lines 5959-6010javascript

5959async function writePng2(model, flags) {

5960 const outPath = flags.pngPath ?? `./chaching-wrapped-${model.month}.png`;

5961 lastPngPath2 = outPath;

5962 let renderWrappedPng2;

5963 try {

5964 ({ renderWrappedPng: renderWrappedPng2 } = await Promise.resolve().then(() => (init_render_png2(), render_png_exports2)));

5965 } catch (err) {

5966 failPng2(err);

5967 }

5968 try {

5969 const png = await renderWrappedPng2(model);

5970 const { writeFile: writeFile2 } = await import("fs/promises");

5971 await writeFile2(outPath, png);

5972 } catch (err) {

5973 failPng2(err);

5974 }

5975}

5976function failPng2(err) {

5977 const msg = err instanceof Error ? err.message : String(err);

5978 const code = err instanceof Error ? err.code : void 0;

5979 const missingDep = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || /Cannot find (package|module) '(satori|@resvg\/resvg-js)'|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/.test(msg);

5980 process.stderr.write(

5982`)

5983 );

5984 process.exit(1);

5985}

5986

5987// src/cli/commands/serve.ts

5988init_personality();

5989init_theme();

5990import { createServer } from "net";

5991import { spawn } from "child_process";

5992import { existsSync as existsSync5 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L5979

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L5990

5993import { readFile as readFile2 } from "fs/promises";

5994import { homedir as homedir4, platform } from "os";

5995import { dirname as dirname6, join as join9 } from "path";

5996import { fileURLToPath as fileURLToPath5 } from "url";

5997

5998// src/lib/core/base-path.js

5999function normalizeBasePath(raw) {

6000 if (raw == null) return "";

6001 const trimmed = raw.trim();

6002 if (trimmed === "" || trimmed === "/") return "";

6003 const inner = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");

6004 return inner === "" ? "" : `/${inner}`;

6005}

6006

6007// src/cli/commands/serve.ts

6008function configPath() {

6009 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join9(homedir4(), ".config");

6010 return join9(configHome, "chaching", "config.json");

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg