registry / drt-method / 1.0.1

drt-method@1.0.1

DRT Method — structured AI-assisted agile development

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 594 KB of source, external domains: api.github.com, astral.sh, docs.astral.sh, github.com, registry.npmjs.org

Source & flagged code

7 flagged

tools/installer/core/uv-check.jsView file

Lines 1-21javascript

1const { spawnSync } = require('node:child_process');

2const prompts = require('../prompts');

High

Child Process

Package source references child process execution.

tools/installer/core/uv-check.jsView on unpkg · L1

4// `uv` (https://docs.astral.sh/uv/) is becoming the de facto standard for

5// running the Python scripts DRT workflows shell out to: `uv run <script>`

6// resolves the interpreter and any dependencies on demand, so skills don't

7// have to assume a particular `python3` is on PATH. The ecosystem is mid-

8// migration — some skills still call `python3` directly — so a missing `uv`

9// is a warning, not a blocker: DRT installs and runs either way.

10const RUNTIME_COMMAND = 'uv';

12/**

13 * Parse `uv --version` output into version parts.

14 * Example outputs: "uv 0.5.31", "uv 0.5.31 (Homebrew 2025-02-12)".

15 * @param {string} output - stdout/stderr from `uv --version`

16 * @returns {{major: number, minor: number, patch: number, raw: string}|null}

17 */

18function parseUvVersion(output) {

19 if (!output) return null;

20 const match = output.match(/uv\s+(\d+)\.(\d+)(?:\.(\d+))?/i);

21 if (!match) return null;

tools/installer/ide/shared/skill-manifest.jsView file

Lines 1-21javascript

1const path = require('node:path');

2const fs = require('../../fs-native');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/installer/ide/shared/skill-manifest.jsView on unpkg · L1

3const yaml = require(

tools/installer/core/installer.jsView file

Lines 670-710javascript

670 throw new Error(`Shared scripts source directory not found: ${srcScriptsDir}`);

671 }

672

673 await fs.remove(paths.scriptsDir);

674 await fs.ensureDir(paths.scriptsDir);

675 const isInstallable =

scripts/install-from-github.shView file

•path = scripts/install-from-github.sh kind = build_helper sizeBytes = 460 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-from-github.shView on unpkg

drt-method-1.0.0.tgzView file

•path = drt-method-1.0.0.tgz kind = high_entropy_blob sizeBytes = 579556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = compressed_blob sizeBytes = 579556 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 579556 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

drt-method-1.0.0.tgzView on unpkg

Source & flagged code

7 flagged · loading source

tools/installer/core/uv-check.jsView file

1const { spawnSync } = require('node:child_process'); L2: const prompts = require('../prompts');

High

Child Process

Package source references child process execution.

tools/installer/core/uv-check.jsView on unpkg · L1

tools/installer/ide/shared/skill-manifest.jsView file

1const path = require('node:path'); L2: const fs = require('../../fs-native');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/installer/ide/shared/skill-manifest.jsView on unpkg · L1

tools/installer/core/installer.jsView file

690const { execSync } = require('node:child_process'); L691: execSync('npm install --omit=dev --no-audit --no-fund', { L692: cwd: paths.scriptsDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/installer/core/installer.jsView on unpkg · L690

scripts/install-from-github.shView file

•path = scripts/install-from-github.sh kind = build_helper sizeBytes = 460 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-from-github.shView on unpkg

drt-method-1.0.0.tgzView file

•path = drt-method-1.0.0.tgz kind = high_entropy_blob sizeBytes = 579556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = compressed_blob sizeBytes = 579556 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 579556 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

drt-method-1.0.0.tgzView on unpkg

Findings

4 High6 Medium5 Low

HighChild Processtools/installer/core/uv-check.js

HighShell

HighRuntime Package Installtools/installer/core/installer.js

HighShips High Entropy Blobdrt-method-1.0.0.tgz

MediumDynamic Requiretools/installer/ide/shared/skill-manifest.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-from-github.sh

MediumShips Compressed Blobdrt-method-1.0.0.tgz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondrt-method-1.0.0.tgz

Source & flagged code

7 flagged

tools/installer/core/uv-check.jsView file

Lines 1-21javascript

1const { spawnSync } = require('node:child_process');

2const prompts = require('../prompts');

High

Child Process

Package source references child process execution.

tools/installer/core/uv-check.jsView on unpkg · L1

4// `uv` (https://docs.astral.sh/uv/) is becoming the de facto standard for

5// running the Python scripts DRT workflows shell out to: `uv run <script>`

6// resolves the interpreter and any dependencies on demand, so skills don't

7// have to assume a particular `python3` is on PATH. The ecosystem is mid-

8// migration — some skills still call `python3` directly — so a missing `uv`

9// is a warning, not a blocker: DRT installs and runs either way.

10const RUNTIME_COMMAND = 'uv';

12/**

13 * Parse `uv --version` output into version parts.

14 * Example outputs: "uv 0.5.31", "uv 0.5.31 (Homebrew 2025-02-12)".

15 * @param {string} output - stdout/stderr from `uv --version`

16 * @returns {{major: number, minor: number, patch: number, raw: string}|null}

17 */

18function parseUvVersion(output) {

19 if (!output) return null;

20 const match = output.match(/uv\s+(\d+)\.(\d+)(?:\.(\d+))?/i);

21 if (!match) return null;

tools/installer/ide/shared/skill-manifest.jsView file

Lines 1-21javascript

1const path = require('node:path');

2const fs = require('../../fs-native');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/installer/ide/shared/skill-manifest.jsView on unpkg · L1

3const yaml = require(

tools/installer/core/installer.jsView file

Lines 670-710javascript

670 throw new Error(`Shared scripts source directory not found: ${srcScriptsDir}`);

671 }

672

673 await fs.remove(paths.scriptsDir);

674 await fs.ensureDir(paths.scriptsDir);

675 const isInstallable =

scripts/install-from-github.shView file

•path = scripts/install-from-github.sh kind = build_helper sizeBytes = 460 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-from-github.shView on unpkg

drt-method-1.0.0.tgzView file

•path = drt-method-1.0.0.tgz kind = high_entropy_blob sizeBytes = 579556 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = compressed_blob sizeBytes = 579556 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

drt-method-1.0.0.tgzView on unpkg

•path = drt-method-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 579556 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

drt-method-1.0.0.tgzView on unpkg