codiedev@0.9.35
⚠ Under reviewConnect Claude Code, Codex, Cursor, OpenCode, or VS Code Copilot to Codiedev for team session capture and artifact collaboration — and run the governed Codie harness
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/hook.jsView file
42const http = __importStar(require("http"));
L43: const child_process_1 = require("child_process");
L44: const utils_1 = require("./utils");
High
dist/codie.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = codiedev@0.9.24
matchedIdentity = npm:Y29kaWVkZXY:0.9.24
similarity = 0.605
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/codie.jsView on unpkg49const path = __importStar(require("path"));
L50: const child_process_1 = require("child_process");
L51: const url_1 = require("url");
...
L58: const result = (0, child_process_1.spawnSync)("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
L59: return result.status === 0 ? result.stdout.trim() : "";
L60: }
...
L74: function existingInlineConfig() {
L75: const raw = process.env.OPENCODE_CONFIG_CONTENT;
L76: if (!raw)
...
L78: try {
L79: return JSON.parse(raw);
L80: }
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/codie.js
HighChild Processdist/hook.js
HighShell
HighSandbox Evasion Gated Capabilitydist/codie.js
HighCross File Remote Execution Contextdist/utils.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codiedev@0.9.35.
See all versions of codiedev for other recorded verdicts.
- Review the evidence and your use of codiedev@0.9.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.