registry / codemore / 0.3.3

codemore@0.3.3

The static analyzer your AI agent reads — finds production-blocking bugs in vibe-coded apps (CLI, GitHub Action, MCP server).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 133 file(s), 1022 KB of source, external domains: api.anthropic.com, api.openai.com, app.example.com, bandit.readthedocs.io, biomejs.dev, codemore.tech, docs.astral.sh, generativelanguage.googleapis.com, github.com, golangci-lint.run, osv.dev, raw.githubusercontent.com, registry.npmjs.org, rust-lang.github.io, rustup.rs, staging.example.com, www.npmjs.com

Source & flagged code

6 flagged

package.jsonView file

Lines 215-255json

215 "description": "Select which analysis tools to use during code analysis"

216 }

217 }

218 }

219 },

220 "scripts": {

221 "dev": "vite --host 0.0.0.0 --port 3000",

222 "build": "vite build",

223 "vscode:prepublish": "npm run package",

224 "compile": "npm run compile:extension && npm run compile:daemon && npm run compile:webview",

225 "compile:extension": "webpack --mode development",

226 "compile:daemon": "webpack --mode development --config webpack.daemon.config.js",

227 "compile:webview": "webpack --mode development --config webpack.webview.config.js",

228 "watch": "concurrently \"npm run watch:extension\" \"npm run watch:daemon\" \"npm run watch:webview\"",

229 "watch:extension": "webpack --mode development --watch",

230 "watch:daemon": "webpack --mode development --watch --config webpack.daemon.config.js",

231 "watch:webview": "webpack --mode development --watch --config webpack.webview.config.js",

232 "package": "webpack --mode production --devtool hidden-source-map && webpack --mode production --config webpack.daemon.config.js && webpack --mode production --config webpack.webview.config.js",

233 "download-binaries": "node scripts/download-binaries.js --current-platform",

234 "download-binaries:all": "node scripts/download-binaries.js",

235 "postinstall": "node scripts/download-binaries.js --skip-download",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L235

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L235

236 "lint": "eslint src daemon webview --ext ts,tsx",

237 "lint:fix": "eslint src daemon webview --ext ts,tsx --fix",

238 "test": "node ./out/test/runTest.js",

239 "test:unit": "mocha --require ts-node/register 'test/**/*.test.ts' --ignore 'test/edh/**'",

240 "test:coverage": "c8 --reporter=text --reporter=text-summary npm run test:unit",

241 "test:mutation": "stryker run",

242 "test:edh:compile": "tsc -p tsconfig.edh.json",

243 "test:edh": "npm run compile:extension && npm run compile:daemon && npm run test:edh:compile && node ./out/test/edh/runTest.js",

244 "pretest": "npm run compile",

245 "cli": "node ./cli.js",

246 "cli:scan": "node ./cli.js scan",

247 "self-scan": "node ./cli.js scan . --fail-on BLOCKER --packs vibe-supabase",

248 "validate-rules": "node scripts/validate-rule-pr.js",

249 "scan:samples": "node scripts/scan-samples.js",

250 "scan:samples:refresh": "node scripts/scan-samples.js --refresh",

251 "build:publish": "tsc -p tsconfig.publish.json",

252 "clean:publish": "node -e \"require('fs').rmSync('lib',{recursive:true,force:true})\"",

253 "prepack": "npm run clean:publish && npm run build:publish",

254 "vsce:package": "npm run download-binaries:all && node scripts/vsce-package.js package",

255 "vsce:publish": "npm run download-binaries:all && node scripts/vsce-package.js publish"

lib/shared/packs/core-security/core-security-eval.jsView file

Lines 1-24javascript

1"use strict";

2/**

3 * Rule: core-security-eval

4 *

5 * Detects `eval(...)` and `new Function(<string args>)` — the two dynamic

6 * code-execution sinks that show up in nearly every shipped XSS / RCE

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/shared/packs/core-security/core-security-eval.jsView on unpkg · L4

7 * incident report. The Function constructor is a "stealth eval": it

8 * compiles its string arguments into a function body, with the same

scripts/download-binaries.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2/* codemore-ignore-file: core-quality-leftover-console, core-bugs-todo-fixme, core-quality-empty-catch */

3/* Build / install script — console output IS the user-facing UX during

4 postinstall and download-binaries. TODOs surface as inventory elsewhere. */

6/**

7 * Download pre-compiled binaries for external analysis tools

8 *

9 * This script downloads and extracts binaries for:

10 * - Semgrep (security scanning)

11 * - Biome (JS/TS linting)

lib/shared/packs/core-security/vibe-ssrf-fetch-user-input.jsView file

Lines 1-24javascript

1"use strict";

2/**

3 * Rule: vibe-ssrf-fetch-user-input

4 *

5 * Detects Server-Side Request Forgery (SSRF) sinks: a `fetch(...)` /

6 * `axios.get(...)` / etc. whose URL argument is sourced from user

7 * input without a visible allowlist or host check.

8 *

9 * Severity: MAJOR.

10 * SSRF can be devastating (cloud metadata, internal services), but

lib/daemon/cli/commands/update.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codemore@0.3.2 matchedIdentity = npm:Y29kZW1vcmU:0.3.2 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/daemon/cli/commands/update.jsView on unpkg

Source & flagged code

6 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code