registry / dejima / 0.8.13

dejima@0.8.13

CLI for Dejima — run a fleet of isolated AI coding agents on hardware you own.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.44 KB of source, external domains: dejima.tech

Source & flagged code

1 flagged

bin/dejima.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Launcher for the `dejima` CLI. The real binary ships INSIDE a per-platform

3// package (@dejima/cli-<platform>-<arch>) declared as an optionalDependency, so

4// npm installs only the one matching this host (os/cpu fields) and skips the

5// rest. There is NO postinstall download — that was blocked by npm 11's default

6// script-blocking and left the CLI non-functional. This shim resolves the

7// platform package and execs its binary, forwarding argv, stdio, and exit code.

8//

9// DEJIMA_BINARY overrides the resolved path (offline installs / CI / a binary

10// you provide yourself, e.g. when installed with --no-optional).

11'use strict';

13const fs = require('fs');

14const path = require('path');

15const { spawnSync } = require('child_process');

17// node's process.platform is already darwin|linux|win32; process.arch is

18// x64|arm64 — the exact suffixes our platform packages use.

19const pkgName = `@dejima/cli-${process.platform}-${process.arch}`;

20const exe = process.platform === 'win32' ? 'dejima.exe' : 'dejima';

22function resolveBinary() {

23 if (process.env.DEJIMA_BINARY) {

24 return process.env.DEJIMA_BINARY;

25 }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dejima.jsView on unpkg · L6

26 // Resolve the package's own package.json (always present + resolvable) and

Source & flagged code

1 flagged · loading source

bin/dejima.jsView file

6// script-blocking and left the CLI non-functional. This shim resolves the L7: // platform package and execs its binary, forwarding argv, stdio, and exit code. L8: // ... L14: const path = require('path'); L15: const { spawnSync } = require('child_process'); L16: L17: // node's process.platform is already darwin|linux|win32; process.arch is L18: // x64|arm64 — the exact suffixes our platform packages use. ... L22: function resolveBinary() { L23: if (process.env.DEJIMA_BINARY) { L24: return process.env.DEJIMA_BINARY; L25: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dejima.jsView on unpkg · L6

Findings

1 High2 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/dejima.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

bin/dejima.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Launcher for the `dejima` CLI. The real binary ships INSIDE a per-platform

3// package (@dejima/cli-<platform>-<arch>) declared as an optionalDependency, so

4// npm installs only the one matching this host (os/cpu fields) and skips the

5// rest. There is NO postinstall download — that was blocked by npm 11's default

6// script-blocking and left the CLI non-functional. This shim resolves the

7// platform package and execs its binary, forwarding argv, stdio, and exit code.

8//

9// DEJIMA_BINARY overrides the resolved path (offline installs / CI / a binary

10// you provide yourself, e.g. when installed with --no-optional).

11'use strict';

13const fs = require('fs');

14const path = require('path');

15const { spawnSync } = require('child_process');

17// node's process.platform is already darwin|linux|win32; process.arch is

18// x64|arm64 — the exact suffixes our platform packages use.

19const pkgName = `@dejima/cli-${process.platform}-${process.arch}`;

20const exe = process.platform === 'win32' ? 'dejima.exe' : 'dejima';

22function resolveBinary() {

23 if (process.env.DEJIMA_BINARY) {

24 return process.env.DEJIMA_BINARY;

25 }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dejima.jsView on unpkg · L6

26 // Resolve the package's own package.json (always present + resolvable) and