registry / dirextalk-deployer / 0.1.22

dirextalk-deployer@0.1.22

Versioned Dirextalk deployer agent skill and portable deployment orchestration tools.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 47.1 KB of source

Source & flagged code

4 flagged

bin/dirextalk-deployer.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/dirextalk-deployer.mjsView on unpkg · L1

4import { homedir } from "node:os";

5import path from "node:path";

6import { fileURLToPath } from "node:url";

8const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

9const packageJson = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));

10const packageName = packageJson.name || "dirextalk-deployer";

11const packageVersion = packageJson.version || "0.0.0";

13const skillFiles = [

14 "AGENTS.md",

15 "LICENSE",

16 "README.md",

17 "README_zh.md",

18 "SKILL.md",

19 "agents",

20 "bin",

21 "package.json",

Lines 325-365javascript

325 }

326 const npmView = spawnSync("npm", ["view", `${packageName}@latest`, "version"], {

327 encoding: "utf8",

328 shell: process.platform === "win32"

329 });

330 if (npmView.status !== 0) {

scripts/mcp-tools-list.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, realpathSync } from "node:fs";

4import path from "node:path";

5import { pathToFileURL } from "node:url";

7const

scripts/pricing-estimate.shView file

•path = scripts/pricing-estimate.sh kind = build_helper sizeBytes = 11782 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pricing-estimate.shView on unpkg

Source & flagged code

4 flagged · loading source

bin/dirextalk-deployer.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/dirextalk-deployer.mjsView on unpkg · L1

345latestVersion, L346: updateCommand: `npm install -g ${packageName}@latest` L347: }; ... L350: function runNpmUpdateAndChildInstall({ agent, scope, target, options, freshness }) { L351: const installResult = spawnSync("npm", ["install", "-g", `${packageName}@latest`], { L352: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/dirextalk-deployer.mjsView on unpkg · L345

scripts/mcp-tools-list.mjsView file

16const sdkRoot = path.join(packageRoot, "node_modules", "@modelcontextprotocol", "sdk", "dist", "esm"); L17: const { Client } = await import(pathToFileURL(path.join(sdkRoot, "client", "index.js")).href); L18: const { StdioClientTransport } = await import(pathToFileURL(path.join(sdkRoot, "client", "stdio.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/mcp-tools-list.mjsView on unpkg · L16

scripts/pricing-estimate.shView file

•path = scripts/pricing-estimate.sh kind = build_helper sizeBytes = 11782 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pricing-estimate.shView on unpkg

Findings

3 High4 Medium2 Low

HighChild Processbin/dirextalk-deployer.mjs

HighShell

HighRuntime Package Installbin/dirextalk-deployer.mjs

MediumDynamic Requirescripts/mcp-tools-list.mjs

MediumEnvironment Vars

MediumShips Build Helperscripts/pricing-estimate.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

bin/dirextalk-deployer.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/dirextalk-deployer.mjsView on unpkg · L1

4import { homedir } from "node:os";

5import path from "node:path";

6import { fileURLToPath } from "node:url";

8const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

9const packageJson = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));

10const packageName = packageJson.name || "dirextalk-deployer";

11const packageVersion = packageJson.version || "0.0.0";

13const skillFiles = [

14 "AGENTS.md",

15 "LICENSE",

16 "README.md",

17 "README_zh.md",

18 "SKILL.md",

19 "agents",

20 "bin",

21 "package.json",

Lines 325-365javascript

325 }

326 const npmView = spawnSync("npm", ["view", `${packageName}@latest`, "version"], {

327 encoding: "utf8",

328 shell: process.platform === "win32"

329 });

330 if (npmView.status !== 0) {

scripts/mcp-tools-list.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { existsSync, realpathSync } from "node:fs";

4import path from "node:path";

5import { pathToFileURL } from "node:url";

7const

scripts/pricing-estimate.shView file

•path = scripts/pricing-estimate.sh kind = build_helper sizeBytes = 11782 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pricing-estimate.shView on unpkg