registry / code-i18n-agent / 0.1.4
code-i18n-agent@0.1.4
智能体：自动将代码项目国际化的扫描-分类-提取-翻译-替换-验证管线（不限于 ERP，适配 Vue/React/TS/JS/HTML）
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/mcp-server.jsView file
54const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
High
Child Process
Package source references child process execution.
dist/mcp-server.jsView on unpkg · L5454Cross-file remote execution chain: dist/mcp-server.js spawns dist/config.js; helper contains network access plus dynamic code execution.
L54: const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
...
L171: // 每行一个 JSON，行尾必须有 \n（MCP stdio 帧分隔）
L172: process.stdout.write(JSON.stringify(msg) + '\n');
L173: }
...
L191: return new Promise((resolve) => {
L192: const cliPath = path.join(__dirname, 'cli.js');
L193: const child = cp.spawn(process.execPath, [cliPath, ...args], {
L194: cwd: process.cwd(),
L195: env: process.env,
L196: windowsHide: true
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/mcp-server.jsView on unpkg · L54package.jsonView file
Findings
3 High2 Medium5 Low
HighChild Processdist/mcp-server.js
HighCross File Remote Execution Contextdist/mcp-server.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to code-i18n-agent@0.1.4.
See all versions of code-i18n-agent for other recorded verdicts.
- Review the evidence and your use of code-i18n-agent@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.