registry / codemore / 0.2.7

codemore@0.2.7

The static analyzer your AI agent reads — finds production-blocking bugs in vibe-coded apps (CLI, GitHub Action, MCP server).

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 140 file(s), 1.62 MB of source, external domains: api.anthropic.com, api.openai.com, app.example.com, bandit.readthedocs.io, biomejs.dev, codemore.tech, docs.astral.sh, generativelanguage.googleapis.com, github.com, golangci-lint.run, osv.dev, raw.githubusercontent.com, reactjs.org, rust-lang.github.io, rustup.rs, staging.example.com, www.npmjs.com, www.w3.org

Oversized source lightweight scan

daemon/dist/index.js4.96 MB file, sampled 256 KB

EnvironmentVarsDynamicRequireHighEntropyStringsMinifiedUrlStringsgenerativelanguage.googleapis.com

Source & flagged code

7 flagged

package.jsonView file

Lines 208-248json

208 "Use only internal static analyzers"

209 ],

210 "description": "Select which analysis tools to use during code analysis"

211 }

212 }

213 }

214 },

215 "scripts": {

216 "vscode:prepublish": "npm run package",

217 "compile": "npm run compile:extension && npm run compile:daemon && npm run compile:webview",

218 "compile:extension": "webpack --mode development",

219 "compile:daemon": "webpack --mode development --config webpack.daemon.config.js",

220 "compile:webview": "webpack --mode development --config webpack.webview.config.js",

221 "watch": "concurrently \"npm run watch:extension\" \"npm run watch:daemon\" \"npm run watch:webview\"",

222 "watch:extension": "webpack --mode development --watch",

223 "watch:daemon": "webpack --mode development --watch --config webpack.daemon.config.js",

224 "watch:webview": "webpack --mode development --watch --config webpack.webview.config.js",

225 "package": "webpack --mode production --devtool hidden-source-map && webpack --mode production --config webpack.daemon.config.js && webpack --mode production --config webpack.webview.config.js",

226 "download-binaries": "node scripts/download-binaries.js --current-platform",

227 "download-binaries:all": "node scripts/download-binaries.js",

228 "postinstall": "node scripts/download-binaries.js --skip-download",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L228

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L228

229 "lint": "eslint src daemon webview --ext ts,tsx",

230 "lint:fix": "eslint src daemon webview --ext ts,tsx --fix",

231 "test": "node ./out/test/runTest.js",

232 "test:unit": "mocha --require ts-node/register 'test/**/*.test.ts' --ignore 'test/edh/**'",

233 "test:coverage": "c8 --reporter=text --reporter=text-summary npm run test:unit",

234 "test:edh:compile": "tsc -p tsconfig.edh.json",

235 "test:edh": "npm run compile:extension && npm run compile:daemon && npm run test:edh:compile && node ./out/test/edh/runTest.js",

236 "pretest": "npm run compile",

237 "cli": "node ./cli.js",

238 "cli:scan": "node ./cli.js scan",

239 "self-scan": "node ./cli.js scan . --fail-on BLOCKER --packs vibe-supabase",

240 "validate-rules": "node scripts/validate-rule-pr.js",

241 "scan:samples": "node scripts/scan-samples.js",

242 "scan:samples:refresh": "node scripts/scan-samples.js --refresh",

243 "build:publish": "tsc -p tsconfig.publish.json",

244 "clean:publish": "node -e \"require('fs').rmSync('lib',{recursive:true,force:true})\"",

245 "prepack": "npm run clean:publish && npm run build:publish",

246 "vsce:package": "npm run download-binaries:all && node scripts/vsce-package.js package",

247 "vsce:publish": "npm run download-binaries:all && node scripts/vsce-package.js publish"

248 },

lib/shared/packs/core-security/core-security-eval.jsView file

Lines 1-24javascript

1"use strict";

2/**

3 * Rule: core-security-eval

4 *

5 * Detects `eval(...)` and `new Function(<string args>)` — the two dynamic

6 * code-execution sinks that show up in nearly every shipped XSS / RCE

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/shared/packs/core-security/core-security-eval.jsView on unpkg · L4

7 * incident report. The Function constructor is a "stealth eval": it

8 * compiles its string arguments into a function body, with the same

dist/extension.jsView file

Lines 1-1javascript

1(()=>{"use strict";var t={520(t,e,s){var n=s(317),i=n.spawn,o=n.exec;function r(t,e,s){var n={};try

lib/shared/packs/core-security/vibe-ssrf-fetch-user-input.jsView file

Lines 1-24javascript

1"use strict";

2/**

3 * Rule: vibe-ssrf-fetch-user-input

4 *

5 * Detects Server-Side Request Forgery (SSRF) sinks: a `fetch(...)` /

6 * `axios.get(...)` / etc. whose URL argument is sourced from user

7 * input without a visible allowlist or host check.

8 *

9 * Severity: MAJOR.

10 * SSRF can be devastating (cloud metadata, internal services), but

11 * the same call shape is also entirely legitimate (proxying public

bin/darwin-x64/ruffView file

•path = bin/darwin-x64/ruff kind = native_binary sizeBytes = 25600356 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/darwin-x64/ruffView on unpkg

daemon/dist/index.jsView file

•path = daemon/dist/index.js kind = oversized_source_file sizeBytes = 5200531 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

daemon/dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/download-binaries.js --skip-download

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/download-binaries.js --skip-download

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/shared/packs/core-security/core-security-eval.jsView file

4* L5: * Detects `eval(...)` and `new Function(<string args>)` — the two dynamic L6: * code-execution sinks that show up in nearly every shipped XSS / RCE

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/shared/packs/core-security/core-security-eval.jsView on unpkg · L4

dist/extension.jsView file

1(()=>{"use strict";var t={520(t,e,s){var n=s(317),i=n.spawn,o=n.exec;function r(t,e,s){var n={};try{Object.keys(t).forEach(function(s){t[s].forEach(function(t){n[t]||(a(t,e),n[t]=1...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extension.jsView on unpkg · L1

lib/shared/packs/core-security/vibe-ssrf-fetch-user-input.jsView file

4* L5: * Detects Server-Side Request Forgery (SSRF) sinks: a `fetch(...)` / L6: * `axios.get(...)` / etc. whose URL argument is sourced from user ... L20: * - `axios.get` / `axios.post` / `axios.put` / `axios.delete` / `axios.patch` L21: * - `got(...)` / `got.get(...)` / `got.post(...)` L22: * - `request(...)` (the `request` npm package) ... L28: * req.body.* / req.query.* / req.params.* / req.headers.* L29: * request.body.* / request.json() result / request.formData() L30: * searchParams.get(...) / url.searchParams.get(...) ... L382: `An attacker can point the request at AWS / GCP metadata endpoints ` + L383: `(169.254.169.254), localhost services, or anywhere on your private network. ` + L384: `Add a host allowlist before issuing the request.`,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/shared/packs/core-security/vibe-ssrf-fetch-user-input.jsView on unpkg · L4

bin/darwin-x64/ruffView file

•path = bin/darwin-x64/ruff kind = native_binary sizeBytes = 25600356 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/darwin-x64/ruffView on unpkg

daemon/dist/index.jsView file

•path = daemon/dist/index.js kind = oversized_source_file sizeBytes = 5200531 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

daemon/dist/index.jsView on unpkg

Findings

3 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accesslib/shared/packs/core-security/vibe-ssrf-fetch-user-input.js

HighOversized Source Filedaemon/dist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/extension.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/darwin-x64/ruff

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/shared/packs/core-security/core-security-eval.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings