registry / dev-tracker-viewer / 0.1.2

dev-tracker-viewer@0.1.2

A viewer for dev-tracker AI spec tracking system

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 573 B of source

Source & flagged code

3 flagged

bin/dev-tracker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process');

3const path = require('path');

High

Child Process

Package source references child process execution.

bin/dev-tracker.jsView on unpkg · L1

5const targetDir = process.cwd();

6const packageDir = path.resolve(__dirname, '..');

8const port = process.env.PORT || '3000';

10const child = spawn('npx', ['next', 'start', '-p', port], {

11 cwd: packageDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/dev-tracker.jsView on unpkg · L9

12 stdio: 'inherit',

13 env: { ...process.env, DEV_TRACKER_TARGET_DIR: targetDir },

14});

16child.on('exit', (code) => process.exit(code ?? 0));

.next/static/media/fe62e8d0a3cf5f1e-s.36_reagd89li4.woff2View file

•path = .[redacted]-s.36_reagd89li4.woff2 kind = high_entropy_blob sizeBytes = 7148 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/static/media/fe62e8d0a3cf5f1e-s.36_reagd89li4.woff2View on unpkg

Source & flagged code

3 flagged · loading source

bin/dev-tracker.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const path = require('path');

High

Child Process

Package source references child process execution.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code