registry / effigent / 0.4.0

effigent@0.4.0

effigent — the Optimizer CLI: capture AI-agent runs (Claude Code, Codex, any OTel agent) and send them to your Optimizer workspace.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 421 KB of source, external domains: api.openai.com, raw.githubusercontent.com, www.apple.com, www.w3.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 19-59javascript

19 for (let key of __getOwnPropNames(from))

20 if (!__hasOwnProp.call(to, key) && key !== except)

21 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

22 }

23 return to;

24};

25var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

26 // If the importer is in node compatibility mode or this is not an ESM

27 // file that has been converted to a CommonJS file using a Babel-

28 // compatible transform (i.e. "__esModule" has not been set), then set

29 // "default" to the CommonJS "module.exports" for node compatibility.

30 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

31 mod

32));

34// ../../node_modules/commander/lib/error.js

35var require_error = __commonJS({

36 "../../node_modules/commander/lib/error.js"(exports) {

37 var CommanderError2 = class extends Error {

38 /**

39 * Constructs the CommanderError class

40 * @param {number} exitCode suggested exit code which could be used with process.exit

41 * @param {string} code an id string representing the error

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L39

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L39

42 * @param {string} message human-readable description of the error

43 */

44 constructor(exitCode, code, message) {

45 super(message);

46 Error.captureStackTrace(this, this.constructor);

47 this.name = this.constructor.name;

48 this.code = code;

49 this.exitCode = exitCode;

50 this.nestedError = void 0;

51 }

52 };

53 var InvalidArgumentError2 = class extends CommanderError2 {

54 /**

55 * Constructs the InvalidArgumentError class

56 * @param {string} [message] explanation of why argument is invalid

57 */

58 constructor(message) {

59 super(1, "commander.invalidArgument", message);

Lines 945-985javascript

945 if (searchingOptions) {

946 similar = similar.map((candidate) => `--${candidate}`);

947 }

948 if (similar.length > 1) {

949 return `

950(Did you mean one of ${similar.join(

Lines 1777-1817javascript

1777 if (cmd.getOptionValueSource(key) !== void 0) {

1778 source = cmd.getOptionValueSource(key);

1779 }

1780 });

1781 return source;

1782 }

1783 /**

1784 * Get user arguments from implied or explicit arguments.

1785 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

dist/index.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

Source & flagged code

5 flagged · loading source

dist/index.jsView file

965var EventEmitter = __require("node:events").EventEmitter; L966: var childProcess = __require("node:child_process"); L967: var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L965

1797} L1798: const execArgv = process2.execArgv ?? []; L1799: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1797

39* Constructs the CommanderError class L40: * @param {number} exitCode suggested exit code which could be used with process.exit L41: * @param {string} code an id string representing the error ... L965: var EventEmitter = __require("node:events").EventEmitter; L966: var childProcess = __require("node:child_process"); L967: var path = __require("node:path"); ... L1014: this._outputConfiguration = { L1015: writeOut: (str) => process2.stdout.write(str), L1016: writeErr: (str) => process2.stderr.write(str), ... L1050: * @returns {Command[]} L1051: * @private L1052: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L39

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L39

dist/index.cjsView file

34Cross-file remote execution chain: dist/index.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L34: * Constructs the CommanderError class L35: * @param {number} exitCode suggested exit code which could be used with process.exit L36: * @param {string} code an id string representing the error ... L960: var EventEmitter = require("node:events").EventEmitter; L961: var childProcess = require("node:child_process"); L962: var path = require("node:path"); ... L1009: this._outputConfiguration = { L1010: writeOut: (str) => process2.stdout.write(str), L1011: writeErr: (str) => process2.stderr.write(str), ... L1045: * @returns {Command[]} L1046: * @private L1047: */

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L34

Findings

4 High4 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextdist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 19-59javascript

19 for (let key of __getOwnPropNames(from))

20 if (!__hasOwnProp.call(to, key) && key !== except)

21 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

22 }

23 return to;

24};

25var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

26 // If the importer is in node compatibility mode or this is not an ESM

27 // file that has been converted to a CommonJS file using a Babel-

28 // compatible transform (i.e. "__esModule" has not been set), then set

29 // "default" to the CommonJS "module.exports" for node compatibility.

30 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

31 mod

32));

34// ../../node_modules/commander/lib/error.js

35var require_error = __commonJS({

36 "../../node_modules/commander/lib/error.js"(exports) {

37 var CommanderError2 = class extends Error {

38 /**

39 * Constructs the CommanderError class

40 * @param {number} exitCode suggested exit code which could be used with process.exit

41 * @param {string} code an id string representing the error

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L39

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L39

42 * @param {string} message human-readable description of the error

43 */

44 constructor(exitCode, code, message) {

45 super(message);

46 Error.captureStackTrace(this, this.constructor);

47 this.name = this.constructor.name;

48 this.code = code;

49 this.exitCode = exitCode;

50 this.nestedError = void 0;

51 }

52 };

53 var InvalidArgumentError2 = class extends CommanderError2 {

54 /**

55 * Constructs the InvalidArgumentError class

56 * @param {string} [message] explanation of why argument is invalid

57 */

58 constructor(message) {

59 super(1, "commander.invalidArgument", message);

Lines 945-985javascript

945 if (searchingOptions) {

946 similar = similar.map((candidate) => `--${candidate}`);

947 }

948 if (similar.length > 1) {

949 return `

950(Did you mean one of ${similar.join(

Lines 1777-1817javascript

1777 if (cmd.getOptionValueSource(key) !== void 0) {

1778 source = cmd.getOptionValueSource(key);

1779 }

1780 });

1781 return source;

1782 }

1783 /**

1784 * Get user arguments from implied or explicit arguments.

1785 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

dist/index.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });