registry / easy-coding-harness / 0.5.3

easy-coding-harness@0.5.3

CLI scaffold for installing Easy Coding harness files into agent-native directories.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 108 KB of source

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 809-849javascript

809 return resolved;

810}

811async function withProjectInstallPaths(cwd, ctx, projectId) {

812 const resolvedProjectId = projectId ?? await readProjectIdIfExists(path8.join(cwd, EASY_CODING_DIR, CONFIG_FILE));

813 return withInstallPaths(cwd, ctx, resolvedProjectId ?? void 0);

814}

815function withInstallPaths(cwd, ctx, projectId) {

816 return {

817 ...ctx,

818 platform_hook_session_start_command: jsonStringContent(

819 renderHookCommand(cwd, ctx, "session-start.py", process.platform, projectId)

820 ),

821 platform_hook_inject_workflow_state_command: jsonStringContent(

822 renderHookCommand(cwd, ctx, "inject-workflow-state.py", process.platform, projectId)

823 ),

824 platform_hook_inject_subagent_context_command: jsonStringContent(

825 renderHookCommand(cwd, ctx, "inject-subagent-context.py", process.platform, projectId)

826 )

827 };

828}

829function renderHookCommand(_cwd, ctx, scriptName, platform = process.platform, projectId) {

830 const launcher = `import base64;exec(base64.b64decode('${Buffer.from(HOOK_LAUNCHER_PYTHON).toString("base64")}').decode())`;

831 const rootIdArg = projectId ? ` ${shellDoubleQuoteArg(projectId, platform)}` : "";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L829

832 return `${ctx.python_cmd} -c ${shellDoubleQuoteArg(launcher, platform)}${rootIdArg} ${ctx.platform_config_dir}/hooks/${scriptName}`;

833}

834function shellDoubleQuoteArg(value, platform = process.platform) {

835 if (platform === "win32") {

836 if (value.includes('"')) {

837 throw new Error("Windows hook paths cannot contain double quotes.");

838 }

839 return `"${value}"`;

840 }

841 return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;

842}

843function jsonStringContent(value) {

844 return JSON.stringify(value).slice(1, -1);

845}

846var HOOK_LAUNCHER_PYTHON = [

847 "import io,json,os,re,runpy,sys",

848 "sys.dont_write_bytecode=True",

849 "from pathlib import Path",

Lines 2743-2783javascript

2743 console.log(` current_task: ${session.current_task} (task.json missing)`);

2744 }

2745 } else {

2746 console.log(" no active session");

2747 }

2748 console.log("");

2749 console.log(chalk5.bold("Tasks"));

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

829function renderHookCommand(_cwd, ctx, scriptName, platform = process.platform, projectId) { L830: const launcher = `import base64;exec(base64.b64decode('${Buffer.from(HOOK_LAUNCHER_PYTHON).toString("base64")}').decode())`; L831: const rootIdArg = projectId ? ` ${shellDoubleQuoteArg(projectId, platform)}` : "";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L829

2763// src/commands/update.ts L2764: import { execFileSync } from "child_process"; L2765: import { cancel as cancel4, confirm as confirm3, outro as outro4 } from "@clack/prompts"; ... L2770: const spec = `${PACKAGE_NAME}@${tag}`; L2771: const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join( L2772: "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L2763

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Findings

3 High3 Medium4 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helpertemplates/shared-hooks/inject-workflow-state.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 809-849javascript

809 return resolved;

810}

811async function withProjectInstallPaths(cwd, ctx, projectId) {

812 const resolvedProjectId = projectId ?? await readProjectIdIfExists(path8.join(cwd, EASY_CODING_DIR, CONFIG_FILE));

813 return withInstallPaths(cwd, ctx, resolvedProjectId ?? void 0);

814}

815function withInstallPaths(cwd, ctx, projectId) {

816 return {

817 ...ctx,

818 platform_hook_session_start_command: jsonStringContent(

819 renderHookCommand(cwd, ctx, "session-start.py", process.platform, projectId)

820 ),

821 platform_hook_inject_workflow_state_command: jsonStringContent(

822 renderHookCommand(cwd, ctx, "inject-workflow-state.py", process.platform, projectId)

823 ),

824 platform_hook_inject_subagent_context_command: jsonStringContent(

825 renderHookCommand(cwd, ctx, "inject-subagent-context.py", process.platform, projectId)

826 )

827 };

828}

829function renderHookCommand(_cwd, ctx, scriptName, platform = process.platform, projectId) {

830 const launcher = `import base64;exec(base64.b64decode('${Buffer.from(HOOK_LAUNCHER_PYTHON).toString("base64")}').decode())`;

831 const rootIdArg = projectId ? ` ${shellDoubleQuoteArg(projectId, platform)}` : "";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L829

832 return `${ctx.python_cmd} -c ${shellDoubleQuoteArg(launcher, platform)}${rootIdArg} ${ctx.platform_config_dir}/hooks/${scriptName}`;

833}

834function shellDoubleQuoteArg(value, platform = process.platform) {

835 if (platform === "win32") {

836 if (value.includes('"')) {

837 throw new Error("Windows hook paths cannot contain double quotes.");

838 }

839 return `"${value}"`;

840 }

841 return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;

842}

843function jsonStringContent(value) {

844 return JSON.stringify(value).slice(1, -1);

845}

846var HOOK_LAUNCHER_PYTHON = [

847 "import io,json,os,re,runpy,sys",

848 "sys.dont_write_bytecode=True",

849 "from pathlib import Path",

Lines 2743-2783javascript

2743 console.log(` current_task: ${session.current_task} (task.json missing)`);

2744 }

2745 } else {

2746 console.log(" no active session");

2747 }

2748 console.log("");

2749 console.log(chalk5.bold("Tasks"));

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg