registry / customize-agent / 4.0.24

customize-agent@4.0.24

通用终端 AI 助手 — 原生 Function Calling + 双语 TUI + 三级模型分层

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 312 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/tui/file-index.jsView file

Lines 1-24javascript

1/**

2 * 按需文件索引 — 首次 @ 触发时 git ls-files 扫描，子串匹配 + 评分排序。

3 * 优先 git ls-files（毫秒级），回退 fast-glob。会话期间缓存。

4 */

5import { execFileSync } from 'child_process';

6import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

Source & flagged code

3 flagged · loading source

dist/tui/file-index.jsView file

4*/ L5: import { execFileSync } from 'child_process'; L6: import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

dist/index.jsView file

188closeSync(logFile.fd); L189: return { ready: true, port, url: `http://localhost:${port}/overview`, logPath: logFile.logPath }; L190: } L191: try { L192: const { spawn } = await import('child_process'); L193: const { closeSync } = await import('fs'); ... L203: env: { L204: ...process.env, L205: NODE_ENV: 'production',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L188

•matchType = previous_version_dangerous_delta matchedPackage = customize-agent@4.0.23 matchedIdentity = npm:Y3VzdG9taXplLWFnZW50:4.0.23 similarity = 0.966 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

4 High3 Medium5 Low

HighChild Processdist/tui/file-index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/index.jsView file

Lines 168-208javascript

168 server.once('listening', () => server.close(() => resolve(true)));

169 server.listen(port, '127.0.0.1');

170 });

171}

172async function resolveDashboardPort(preferredPort) {

173 if (await portHasHealthyDashboard(preferredPort))

174 return preferredPort;

175 if (await portIsAvailable(preferredPort))

176 return preferredPort;

177 for (let port = preferredPort + 1; port <= preferredPort + 50; port += 1) {

178 if (await portIsAvailable(port))

179 return port;

180 }

181 return preferredPort;

182}

183async function startDashboardInBackground(port) {

184 let logPath = '';

185 if (await waitForDashboard(port, 1000)) {

186 const { closeSync } = await import('fs');

187 const logFile = await dashboardLogFile(port);

188 closeSync(logFile.fd);

189 return { ready: true, port, url: `http://localhost:${port}/overview`, logPath: logFile.logPath };

190 }

191 try {

192 const { spawn } = await import('child_process');

193 const { closeSync } = await import('fs');

194 const serverPackageJson = require.resolve('@customize-agent/server/package.json');

195 const serverRoot = dirname(serverPackageJson);

196 const nextBin = require.resolve('next/dist/bin/next', { paths: [serverRoot] });

197 const logFile = await dashboardLogFile(port);

198 logPath = logFile.logPath;

199 const child = spawn(process.execPath, [nextBin, 'start', '-p', String(port), '-H', '127.0.0.1'], {

200 cwd: serverRoot,

201 detached: false,

202 stdio: ['ignore', logFile.fd, logFile.fd],

203 env: {

204 ...process.env,

205 NODE_ENV: 'production',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L188

206 CUSTOMIZE_PROJECT_ROOT: PROJECT_ROOT,

207 },

208 });

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg