registry / customize-agent / 2.1.31

customize-agent@2.1.31

通用终端 AI 助手 — 原生 Function Calling + 双语 TUI + 三级模型分层

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 871 KB of source, external domains: api.anthropic.com, api.deepseek.com, generativelanguage.googleapis.com, github.com, openrouter.ai

Source & flagged code

6 flagged

dist/tui/file-index.jsView file

Lines 1-24javascript

1/**

2 * 按需文件索引 — 首次 @ 触发时 git ls-files 扫描，子串匹配 + 评分排序。

3 * 优先 git ls-files（毫秒级），回退 fast-glob。会话期间缓存。

4 */

5import { execFileSync } from 'child_process';

6import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

7export class FileIndex {

8 files = null;

9 root;

10 constructor(root) { this.root = root; }

11 /** 子串匹配 + 按匹配位置/路径长度评分排序，最多 max 条 */

12 search(partial, max = 12) {

13 if (!this.files)

14 this._build();

15 const lower = partial.toLowerCase();

16 const scored = [];

17 for (const f of this.files) {

18 const idx = f.toLowerCase().indexOf(lower);

19 if (idx >= 0) {

20 scored.push({ f, s: idx * 10000 + f.length });

21 }

22 }

23 scored.sort((a, b) => a.s - b.s);

24 return scored.slice(0, max).map(x => x.f);

dist/index.jsView file

Lines 15-55javascript

15import { I18nManager } from './i18n/manager.js';

16function resolveUserProjectRoot() {

17 return resolve(process.env.CUSTOMIZE_PROJECT_ROOT ?? process.env.INIT_CWD ?? process.env.PWD ?? process.cwd());

18}

19function

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView file

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = payload_in_excluded_dir sizeBytes = 2459403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = oversized_source_file sizeBytes = 2459403 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/tui/file-index.jsView file

4*/ L5: import { execFileSync } from 'child_process'; L6: import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

dist/index.jsView file

282return { client, status: `ChromaDB: 已连接 ${client.baseUrl}` }; L283: const { spawn } = await import('child_process'); L284: let port = chromaPort(client); ... L286: port += 1; L287: process.env.CHROMA_URL = `http://localhost:${port}`; L288: client = new ChromaHttpClient();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L282

•matchType = previous_version_dangerous_delta matchedPackage = customize-agent@2.1.28 matchedIdentity = npm:Y3VzdG9taXplLWFnZW50:2.1.28 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

35if (process.platform === 'win32') { L36: const { execSync } = require('child_process'); L37: execSync(`taskkill /F /PID ${pid}`, { timeout: 3000, stdio: 'ignore' });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L35

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView file

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = payload_in_excluded_dir sizeBytes = 2459403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = oversized_source_file sizeBytes = 2459403 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

Findings

6 High4 Medium5 Low

HighChild Processdist/tui/file-index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighPayload In Excluded Dirdist/server-bundle/apps/server/.next/server/chunks/5076.js

HighOversized Source Filedist/server-bundle/apps/server/.next/server/chunks/5076.js

HighPrevious Version Dangerous Deltadist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/tui/file-index.jsView file

Lines 1-24javascript

1/**

2 * 按需文件索引 — 首次 @ 触发时 git ls-files 扫描，子串匹配 + 评分排序。

3 * 优先 git ls-files（毫秒级），回退 fast-glob。会话期间缓存。

4 */

5import { execFileSync } from 'child_process';

6import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

7export class FileIndex {

8 files = null;

9 root;

10 constructor(root) { this.root = root; }

11 /** 子串匹配 + 按匹配位置/路径长度评分排序，最多 max 条 */

12 search(partial, max = 12) {

13 if (!this.files)

14 this._build();

15 const lower = partial.toLowerCase();

16 const scored = [];

17 for (const f of this.files) {

18 const idx = f.toLowerCase().indexOf(lower);

19 if (idx >= 0) {

20 scored.push({ f, s: idx * 10000 + f.length });

21 }

22 }

23 scored.sort((a, b) => a.s - b.s);

24 return scored.slice(0, max).map(x => x.f);

dist/index.jsView file

Lines 15-55javascript

15import { I18nManager } from './i18n/manager.js';

16function resolveUserProjectRoot() {

17 return resolve(process.env.CUSTOMIZE_PROJECT_ROOT ?? process.env.INIT_CWD ?? process.env.PWD ?? process.cwd());

18}

19function

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView file

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = payload_in_excluded_dir sizeBytes = 2459403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

•path = dist/server-bundle/apps/server/.next/server/chunks/5076.js kind = oversized_source_file sizeBytes = 2459403 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server-bundle/apps/server/.next/server/chunks/5076.jsView on unpkg

Lines 262-302javascript

262 process.kill(pid, 'SIGTERM');

263 }

264 catch { /* ignore stale process */ }

265 }

266 if (pids.length > 0)

267 await new Promise(resolve => setTimeout(resolve, 800));

268 const remaining = await listeningPids(port);

269 for (const pid of remaining) {

270 try {

271 process.kill(pid, 'SIGKILL');

272 }

273 catch { /* ignore stale process */ }

274 }

275 if (remaining.length > 0)

276 await new Promise(resolve => setTimeout(resolve, 500));

277 return (await listeningPids(port)).length === 0;

278}

279async function ensureChromaServer() {

280 let client = new ChromaHttpClient();

281 if (await client.heartbeat())

282 return { client, status: `ChromaDB: 已连接 ${client.baseUrl}` };

283 const { spawn } = await import('child_process');

284 let port = chromaPort(client);

285 if (!await stopProcessListeningOnPort(port)) {

286 port += 1;

287 process.env.CHROMA_URL = `http://localhost:${port}`;

288 client = new ChromaHttpClient();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L282

289 }

290 const logFile = await runtimeLogFile('chroma', port);

291 const chromaCommand = await resolveChromaCommand();

292 if (!chromaCommand) {

293 const { closeSync } = await import('fs');

294 try {

295 closeSync(logFile.fd);

296 }

297 catch { /* ignore */ }

298 return { client, status: 'ChromaDB: 正在准备向量服务' };

299 }

300 try {

301 const dataDir = await chromaDataDir();

302 const proc = spawn(chromaCommand.command, [...chromaCommand.argsPrefix, 'run', '--host', 'localhost', '--port', String(port), '--path', dataDir], {