registry / docdex / 0.2.89

docdex@0.2.89

⚠ Under review

Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 285 KB of source, external domains: 127.0.0.1, github.com, ollama.com, registry.npmjs.org, www.apple.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-40json

2 "name": "docdex",

3 "version": "0.2.89",

4 "mcpName": "io.github.bekirdag/docdex",

5 "description": "Local-first documentation and code indexer with HTTP/MCP search, AST, and agent memory.",

6 "bin": {

7 "docdex": "lib/cli_entry.js",

8 "docdexd": "lib/cli_entry.js",

9 "docdex-mcp-stdio": "lib/mcp_stdio_cli.js"

10 },

11 "files": [

12 "bin",

13 "lib",

14 "assets",

15 "README.md",

16 "CHANGELOG.md",

17 "LICENSE"

18 ],

19 "scripts": {

20 "postinstall": "node ./lib/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node ./lib/uninstall.js",

22 "postuninstall": "node ./lib/uninstall.js",

23 "test": "node --test",

24 "pack:verify": "node --test test/packaging_guardrails.test.js"

25 },

26 "engines": {

27 "node": ">=18"

28 },

29 "os": [

30 "darwin",

31 "linux",

32 "win32"

33 ],

34 "cpu": [

35 "arm64",

36 "x64"

37 ],

38 "repository": {

39 "type": "git",

40 "url": "git+https://github.com/bekirdag/docdex.git"

bin/docdex-mcp-stdio.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2"use strict";

4const { runBridge } = require("../lib/mcp_stdio_bridge");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docdex-mcp-stdio.jsView on unpkg · L3

6async function

lib/postinstall_setup.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const net = require("node:net");

lib/install.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

lib/install.jsView on unpkg · L1

4const fs = require("node:fs");

5const http =

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code