cladding@0.7.0: Suspicious npm security report (Warn)

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 3.27 MB of source, external domains: api.anthropic.com, docs.anthropic.com, docs.expo.dev, github.com, jcgt.org, json-schema.org, platform.claude.com, raw.githubusercontent.com, www.w3.org

Source & flagged code

5 flagged

dist/clad.jsView file

18(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L19: (Did you mean ${n[0]}?)`:""}R2.suggestSimilar=Mae});var M2=b(Yk=>{var Fae=Ue("node:events").EventEmitter,Vk=Ue("node:child_process"),Li=Ue("node:path"),Jh=Ue("node:fs"),ze=Ue("node... L20: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...

High

Child Process

Package source references child process execution.

dist/clad.jsView on unpkg · L18

582`)}function aTe(t,e){let r=[UJ,"",`# ${e} \u2014 Project Context`,""];if(r.push("## 1. What this project is (observed)",""),t.readmeFirstParagraph?r.push(`> ${t.readmeFirstParagrap... L583: `)}If();import{readFileSync as a1e}from"node:fs";import{join as c1e}from"node:path";var l1e="claude-sonnet-4-6",ES=16384;function u1e(t,e="."){if(t)return t;try{let n=a1e(c1e(e,".c... L584: `)}function Sp(t){let e=z8(t);return["# Cladding \xB7 Tier B \xB7 SSoT \u2014 editable, cross-validated \xB7 Refreshed by: clad init / clad refine","# Greenfield seed \u2014 no imp... ... L586: `)}var $1=$t(rr(),1);ci();var q8="\n`;function... L588: `)}function B8(t){return{mode:Qo(t,"ONBOARDING_MODE"),projectContext:Qo(t,"PROJECT_CONTEXT_MD"),capabilities:Qo(t,"CAPABILITIES_YAML"),architecture:Qo(t,"ARCHITECTURE_YAML"),specSe...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/clad.jsView on unpkg · L582

329`,c=Math.max(0,s-a.length);return{path:t,text:o.slice(0,c)+a,truncated:!0,bytes:i}}var XDe,QDe,eNe,V1=y(()=>{"use strict";XDe=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py"... L330: `,1)[0]??"",n=uNe.exec(r);if(n)return n[1]}catch{}return dNe.get(t)}function Ea(t,e="."){let r=new Map,n=new Set,i=[],o=l=>{r.has(l.id)||r.set(l.id,l)},s=(l,u,d)=>{let f=`${d}\0${l... L331: `)?`\r ... L335: `?s.replace(/\n/g,`\r L336: `):s}function dw(t="."){let e=uw(t,"spec.yaml");if(!lw(e))return null;let r=IX(e,"utf8");if(PX(r))return null;let n=oje(t);if(!n)return null;let i=sje(r,n);return i!==r?(QNe(e,i),n... L337: `)}var l7,sm,Cr,HD=y(()=>{Pa();Q();l7=(t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerable:!... L338: `).filter(s=>s),i=Math.min(...n.map(s=>s.length-s.trimStart().length)),o=n.map(s=>s.slice(i)).map(s=>" ".repeat(this.indent*2)+s);for(let s of o)this.content.push(s)}compile(){let ... L339: `))}}});var LN,UN=y(()=>{LN={major:4,minor:4,patch:3}});function VN(t){if(t==="")return!0;if(/\s/.test(t)||t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function z7... L340: if (${w}.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/clad.jsView on unpkg · L329

6Cross-file remote execution chain: dist/clad.js spawns dist/viewer/app.js; helper contains network access plus dynamic code execution. L6: globalThis.__CLADDING_BUNDLED = true; L7: var kae=Object.create;var Nk=Object.defineProperty;var Eae=Object.getOwnPropertyDescriptor;var Aae=Object.getOwnPropertyNames;var Tae=Object.getPrototypeOf,Oae=Object.prototype.has... L8: `)}displayWidth(e){return I2(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT... ... L18: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L19: (Did you mean ${n[0]}?)`:""}R2.suggestSimilar=Mae});var M2=b(Yk=>{var Fae=Ue("node:events").EventEmitter,Vk=Ue("node:child_process"),Li=Ue("node:path"),Jh=Ue("node:fs"),ze=Ue("node... L20: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L81: `;return`${m} L82: ${i}${p}`}else return`${f}${s}${d.join(" ")}${s}${p}`}function vg({indent:t,options:{commentString:e}},r,n,i){if(n&&i&&(n=n.replace(/^\n+/,"")),n){let o=_g.indentComment(e(n),t…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/clad.jsView on unpkg · L6

407|| (${s} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(a,(0,_e._)`+${i}`);return;case"boolean":n.elseIf((0,_e._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L408: || ${s} === "boolean" || ${i} === null`).assign(a,(0,_e._)`[${i}]`)}}}function iUe({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,_e._)`${e} !== undefined`,()=>t.assign((0,_e... L409: missingProperty: ${n},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/clad.jsView on unpkg · L407

Source & flagged code

5 flagged · loading source

dist/clad.jsView file

18(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L19: (Did you mean ${n[0]}?)`:""}R2.suggestSimilar=Mae});var M2=b(Yk=>{var Fae=Ue("node:events").EventEmitter,Vk=Ue("node:child_process"),Li=Ue("node:path"),Jh=Ue("node:fs"),ze=Ue("node... L20: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...

High

Child Process

Package source references child process execution.

dist/clad.jsView on unpkg · L18

582`)}function aTe(t,e){let r=[UJ,"",`# ${e} \u2014 Project Context`,""];if(r.push("## 1. What this project is (observed)",""),t.readmeFirstParagraph?r.push(`> ${t.readmeFirstParagrap... L583: `)}If();import{readFileSync as a1e}from"node:fs";import{join as c1e}from"node:path";var l1e="claude-sonnet-4-6",ES=16384;function u1e(t,e="."){if(t)return t;try{let n=a1e(c1e(e,".c... L584: `)}function Sp(t){let e=z8(t);return["# Cladding \xB7 Tier B \xB7 SSoT \u2014 editable, cross-validated \xB7 Refreshed by: clad init / clad refine","# Greenfield seed \u2014 no imp... ... L586: `)}var $1=$t(rr(),1);ci();var q8="\n`;function... L588: `)}function B8(t){return{mode:Qo(t,"ONBOARDING_MODE"),projectContext:Qo(t,"PROJECT_CONTEXT_MD"),capabilities:Qo(t,"CAPABILITIES_YAML"),architecture:Qo(t,"ARCHITECTURE_YAML"),specSe...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/clad.jsView on unpkg · L582

329`,c=Math.max(0,s-a.length);return{path:t,text:o.slice(0,c)+a,truncated:!0,bytes:i}}var XDe,QDe,eNe,V1=y(()=>{"use strict";XDe=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py"... L330: `,1)[0]??"",n=uNe.exec(r);if(n)return n[1]}catch{}return dNe.get(t)}function Ea(t,e="."){let r=new Map,n=new Set,i=[],o=l=>{r.has(l.id)||r.set(l.id,l)},s=(l,u,d)=>{let f=`${d}\0${l... L331: `)?`\r ... L335: `?s.replace(/\n/g,`\r L336: `):s}function dw(t="."){let e=uw(t,"spec.yaml");if(!lw(e))return null;let r=IX(e,"utf8");if(PX(r))return null;let n=oje(t);if(!n)return null;let i=sje(r,n);return i!==r?(QNe(e,i),n... L337: `)}var l7,sm,Cr,HD=y(()=>{Pa();Q();l7=(t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerable:!... L338: `).filter(s=>s),i=Math.min(...n.map(s=>s.length-s.trimStart().length)),o=n.map(s=>s.slice(i)).map(s=>" ".repeat(this.indent*2)+s);for(let s of o)this.content.push(s)}compile(){let ... L339: `))}}});var LN,UN=y(()=>{LN={major:4,minor:4,patch:3}});function VN(t){if(t==="")return!0;if(/\s/.test(t)||t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function z7... L340: if (${w}.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/clad.jsView on unpkg · L329

6Cross-file remote execution chain: dist/clad.js spawns dist/viewer/app.js; helper contains network access plus dynamic code execution. L6: globalThis.__CLADDING_BUNDLED = true; L7: var kae=Object.create;var Nk=Object.defineProperty;var Eae=Object.getOwnPropertyDescriptor;var Aae=Object.getOwnPropertyNames;var Tae=Object.getPrototypeOf,Oae=Object.prototype.has... L8: `)}displayWidth(e){return I2(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT... ... L18: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L19: (Did you mean ${n[0]}?)`:""}R2.suggestSimilar=Mae});var M2=b(Yk=>{var Fae=Ue("node:events").EventEmitter,Vk=Ue("node:child_process"),Li=Ue("node:path"),Jh=Ue("node:fs"),ze=Ue("node... L20: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L81: `;return`${m} L82: ${i}${p}`}else return`${f}${s}${d.join(" ")}${s}${p}`}function vg({indent:t,options:{commentString:e}},r,n,i){if(n&&i&&(n=n.replace(/^\n+/,"")),n){let o=_g.indentComment(e(n),t…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/clad.jsView on unpkg · L6

407|| (${s} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(a,(0,_e._)`+${i}`);return;case"boolean":n.elseIf((0,_e._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L408: || ${s} === "boolean" || ${i} === null`).assign(a,(0,_e._)`[${i}]`)}}}function iUe({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,_e._)`${e} !== undefined`,()=>t.assign((0,_e... L409: missingProperty: ${n},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/clad.jsView on unpkg · L407

Findings

4 High4 Medium7 Low

HighChild Processdist/clad.js

HighSame File Env Network Executiondist/clad.js

HighCommand Output Exfiltrationdist/clad.js

HighCross File Remote Execution Contextdist/clad.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/clad.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings