registry / cicy-code / 2.3.138

cicy-code@2.3.138

CiCy Code - AI-powered development environment

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.18 KB of source, external domains: registry.npmmirror.com

Source & flagged code

1 flagged

bin/cicy-code.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Launcher for the npm distribution. Resolves the prebuilt binary that ships

3// in the platform-specific optionalDependency (cicy-code-<os>-<cpu>) and execs

4// it — no network, no postinstall download. ALL binary args/subcommands are

5// passed straight through (skill <...>, --dev, --hot, --helper=1, --agents=…,

6// --public, --cn, etc.), so `npx cicy-code <anything>` == the binary.

7//

8// Only when actually starting the server, it mirrors dev.py's startup: if PORT

9// (default 8008) is held by a *cicy-code* process it kills it and waits, so a

10// stale instance never blocks the new one. A non-cicy occupant is left alone

11// and we abort. Utility invocations (--help/--version, `skill …`) skip the

12// port dance entirely — `npx cicy-code --version` must never touch :8008.

13const { spawn, execSync } = require('child_process');

14const fs = require('fs');

16const args = process.argv.slice(2);

17const PORT = process.env.PORT || '8008';

19// Package name uses "windows", not the process.platform value "win32":

20// npm's spam filter rejects (403) new package names containing win32.

21const platformName = process.platform === 'win32' ? 'windows' : process.platform;

22const platformPkg = `cicy-code-${platformName}-${process.arch}`;

23// Windows ships the binary with the .exe extension (CreateProcess requires it).

24const binName = process.platform === 'win32' ? 'cicy-code.exe' : 'cicy-code';

25let binPath;

26try {

27 binPath = require.resolve(`${platformPkg}/${binName}`);

28} catch {

29 console.error(`cicy-code: no prebuilt binary for ${process.platform}-${process.arch}.`);

30 console.error(`The optional dependency "${platformPkg}" is not installed.`);

31 console.error(`Supported platforms: darwin-arm64, darwin-x64, linux-x64, linux-arm64, windows-x64.`);

32 console.error(`Reinstall: npm install -g cicy-code` +

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cicy-code.jsView on unpkg · L12

Source & flagged code

1 flagged · loading source

bin/cicy-code.jsView file

12// port dance entirely — `npx cicy-code --version` must never touch :8008. L13: const { spawn, execSync } = require('child_process'); L14: const fs = require('fs'); ... L16: const args = process.argv.slice(2); L17: const PORT = process.env.PORT || '8008'; L18: L19: // Package name uses "windows", not the process.platform value "win32": L20: // npm's spam filter rejects (403) new package names containing win32. ... L32: console.error(`Reinstall: npm install -g cicy-code` + L33: ` (in China add --registry=https://registry.npmmirror.com)`); L34: process.exit(1);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cicy-code.jsView on unpkg · L12

Findings

1 High1 Medium2 Low

HighSandbox Evasion Gated Capabilitybin/cicy-code.js

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

bin/cicy-code.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Launcher for the npm distribution. Resolves the prebuilt binary that ships

3// in the platform-specific optionalDependency (cicy-code-<os>-<cpu>) and execs

4// it — no network, no postinstall download. ALL binary args/subcommands are

5// passed straight through (skill <...>, --dev, --hot, --helper=1, --agents=…,

6// --public, --cn, etc.), so `npx cicy-code <anything>` == the binary.

7//

8// Only when actually starting the server, it mirrors dev.py's startup: if PORT

9// (default 8008) is held by a *cicy-code* process it kills it and waits, so a

10// stale instance never blocks the new one. A non-cicy occupant is left alone

11// and we abort. Utility invocations (--help/--version, `skill …`) skip the

12// port dance entirely — `npx cicy-code --version` must never touch :8008.

13const { spawn, execSync } = require('child_process');

14const fs = require('fs');

16const args = process.argv.slice(2);

17const PORT = process.env.PORT || '8008';

19// Package name uses "windows", not the process.platform value "win32":

20// npm's spam filter rejects (403) new package names containing win32.

21const platformName = process.platform === 'win32' ? 'windows' : process.platform;

22const platformPkg = `cicy-code-${platformName}-${process.arch}`;

23// Windows ships the binary with the .exe extension (CreateProcess requires it).

24const binName = process.platform === 'win32' ? 'cicy-code.exe' : 'cicy-code';

25let binPath;

26try {

27 binPath = require.resolve(`${platformPkg}/${binName}`);

28} catch {

29 console.error(`cicy-code: no prebuilt binary for ${process.platform}-${process.arch}.`);

30 console.error(`The optional dependency "${platformPkg}" is not installed.`);

31 console.error(`Supported platforms: darwin-arm64, darwin-x64, linux-x64, linux-arm64, windows-x64.`);

32 console.error(`Reinstall: npm install -g cicy-code` +

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cicy-code.jsView on unpkg · L12