registry  /  embedlabs  /  0.1.0-alpha.136

embedlabs@0.1.0-alpha.136

EmbedLabs CLI alias package for local-first embedded agent testing.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemShell
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 2 file(s), 4.93 KB of source

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node bin/install-progress.js postinstall
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.preinstall = node bin/install-progress.js preinstall
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
•scripts.postinstall = node bin/install-progress.js postinstall
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/install-progress.jsView file
1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L39: return ( L40: process.stdout.isTTY || L41: process.env.npm[redacted] === "true" || L42: process.env.EMBEDLABS_INSTALL_FORCE_PROGRESS === "1" || ... L50: if (process.stdout.isTTY || process.env.EMBEDLABS_INSTALL_NO_TTY === "1") { L51: process.stdout.write(line); L52: return; ... L79: } L80: spawnSync("schtasks.exe", ["/Delete", "/TN", "EmbedLabsLocalBridge", "/F"], { stdio: "ignore" });
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/install-progress.jsView on unpkg · L1

Findings

1 High4 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumInstall Persistencebin/install-progress.js
LowScripts Present
LowFilesystem
LowNo License