registry / chaching / 1.7.2

chaching@1.7.2

Local multi-provider AI token spend dashboard for Claude Code, Codex, OpenCode, and Cursor.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 1.41 MB of source, external domains: api.cursor.com, datatracker.ietf.org, my.site, npmjs.com, svelte.dev, www.w3.org

Source & flagged code

4 flagged

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

12const rootDir = join(dirname(fileURLToPath(import.meta.url)), '..');

13const cliEntry = join(rootDir, 'dist', 'cli', 'index.js');

14const buildEntry = join(rootDir, 'build', 'index.js');

16// `serve` is the one long-running command whose work outlives the CLI promise:

17// the imported adapter-node server starts listening and then the import resolves,

18// so the listening socket keeps the process alive on its own. Every other command

19// is one-shot, and the bundled graph (Ink/clack touch stdin at import) leaves a

20// module-level handle that would otherwise stop the process exiting — so we force

21// a clean exit for those, but NOT for `serve` (which must keep running).

22const firstArg = process.argv.slice(2).find((a) => !a.startsWith('-'));

23const isLongRunning = firstArg === 'serve';

25// ── 1. Prefer the CLI bundle ──────────────────────────────────────────────────

26if (existsSync(cliEntry)) {

27 await import(cliEntry);

28 // One-shot commands must be force-exited: the bundled graph (Ink/clack touch

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/chaching.jsView on unpkg · L26

29 // stdin at import) leaves a module-level handle that blocks a natural exit.

30 // `serve` is exempt — its listening socket keeps the process alive on its own.

31 if (!isLongRunning) process.exit(0);

32} else {

33 // ── 2. Legacy fallback: bare server boot ─────────────────────────────────────

34 // Reached only when dist/cli/ is missing (e.g. `npm run build:sk` without

35 // `build:cli`). Warn the user so they know to run the full build.

36 console.error('[chaching] CLI bundle not found at dist/cli/index.js.');

37 console.error('Run `npm run build:cli` (or `npm run build`) to build it.');

38 console.error('Falling back to direct server boot for `chaching serve`...\n');

40 if (!existsSync(buildEntry)) {

41 console.error('[chaching] SvelteKit build artifact also missing. Run `npm run build`.');

42 process.exit(1);

43 }

45 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config');

46 const configFile = join(configHome, 'chaching', 'config.json');

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = chaching@1.12.0 matchedIdentity = npm:Y2hhY2hpbmc:1.12.0 similarity = 0.675 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/chaching.jsView file

26if (existsSync(cliEntry)) { L27: await import(cliEntry); L28: // One-shot commands must be force-exited: the bundled graph (Ink/clack touch

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/chaching.jsView on unpkg · L26

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

dist/cli/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Findings

2 High5 Medium5 Low

HighShips High Entropy Blobstatic/fonts/space-grotesk-latin-700-normal.woff2

HighPrevious Version Dangerous Deltadist/cli/index.js

MediumDynamic Requirebin/chaching.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbuild/client/robots.txt.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/chaching.jsView file

Lines 6-46javascript

6import { existsSync } from 'node:fs';

7import { readFile } from 'node:fs/promises';

8import { homedir } from 'node:os';

9import { dirname, join } from 'node:path';

10import { fileURLToPath } from 'node:url';

12const rootDir = join(dirname(fileURLToPath(import.meta.url)), '..');

13const cliEntry = join(rootDir, 'dist', 'cli', 'index.js');

14const buildEntry = join(rootDir, 'build', 'index.js');

16// `serve` is the one long-running command whose work outlives the CLI promise:

17// the imported adapter-node server starts listening and then the import resolves,

18// so the listening socket keeps the process alive on its own. Every other command

19// is one-shot, and the bundled graph (Ink/clack touch stdin at import) leaves a

20// module-level handle that would otherwise stop the process exiting — so we force

21// a clean exit for those, but NOT for `serve` (which must keep running).

22const firstArg = process.argv.slice(2).find((a) => !a.startsWith('-'));

23const isLongRunning = firstArg === 'serve';

25// ── 1. Prefer the CLI bundle ──────────────────────────────────────────────────

26if (existsSync(cliEntry)) {

27 await import(cliEntry);

28 // One-shot commands must be force-exited: the bundled graph (Ink/clack touch

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/chaching.jsView on unpkg · L26

29 // stdin at import) leaves a module-level handle that blocks a natural exit.

30 // `serve` is exempt — its listening socket keeps the process alive on its own.

31 if (!isLongRunning) process.exit(0);

32} else {

33 // ── 2. Legacy fallback: bare server boot ─────────────────────────────────────

34 // Reached only when dist/cli/ is missing (e.g. `npm run build:sk` without

35 // `build:cli`). Warn the user so they know to run the full build.

36 console.error('[chaching] CLI bundle not found at dist/cli/index.js.');

37 console.error('Run `npm run build:cli` (or `npm run build`) to build it.');

38 console.error('Falling back to direct server boot for `chaching serve`...\n');

40 if (!existsSync(buildEntry)) {

41 console.error('[chaching] SvelteKit build artifact also missing. Run `npm run build`.');

42 process.exit(1);

43 }

45 const configHome = process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), '.config');

46 const configFile = join(configHome, 'chaching', 'config.json');

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 67 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

static/fonts/space-grotesk-latin-700-normal.woff2View file

•path = static/fonts/space-grotesk-latin-700-normal.woff2 kind = high_entropy_blob sizeBytes = 12840 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/fonts/space-grotesk-latin-700-normal.woff2View on unpkg

dist/cli/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg