registry / flowmind / 1.5.7

flowmind@1.5.7

Memory and workflow automation for MCP, Codex, and Claude Code. Reuse repeatable developer operations through skills and explicit feedback.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 474 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.mimo.ai, api.openai.com, cli.github.com, dashscope.aliyuncs.com, open.bigmodel.cn, yapi.example.com

Source & flagged code

5 flagged

core/update-notifier.jsView file

Lines 1-21javascript

1const { execFile, execSync } = require('child_process');

2const { promisify } = require('util');

High

Child Process

Package source references child process execution.

core/update-notifier.jsView on unpkg · L1

4function compareVersions(currentVersion, latestVersion) {

5 const current = parseVersion(currentVersion);

6 const latest = parseVersion(latestVersion);

8 for (let index = 0; index < 3; index += 1) {

9 if (latest[index] > current[index]) return -1;

10 if (latest[index] < current[index]) return 1;

11 }

13 return 0;

14}

16function parseVersion(version) {

17 return String(version || '0.0.0')

18 .split('.')

19 .slice(0, 3)

20 .map((part) => Number.parseInt(part, 10) || 0);

21}

bin/flowmind.jsView file

Lines 1571-1611javascript

1571

1572 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1573}

1574

1575function formatFileSize(bytes) {

1576 if (bytes === 0) return '0 B';

1577 const

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Source & flagged code

5 flagged · loading source

core/update-notifier.jsView file

1const { execFile, execSync } = require('child_process'); L2: const { promisify } = require('util');

High

Child Process

Package source references child process execution.

core/update-notifier.jsView on unpkg · L1

bin/flowmind.jsView file

1591stdio: 'inherit', L1592: shell: true L1593: });

High

Shell

Package source references shell execution.

bin/flowmind.jsView on unpkg · L1591

1761try { L1762: const globalRoot = execSync('npm root -g', { encoding: 'utf-8' }).trim(); L1763: const localPath = require.resolve('../package.json'); ... L1768: const installCmd = isGlobal L1769: ? `npm install -g flowmind@${latestVersion}` L1770: : `npm install flowmind@${latestVersion}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/flowmind.jsView on unpkg · L1761

core/honor-engine.jsView file

5L6: const fs = require('fs-extra'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/honor-engine.jsView on unpkg · L5

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processcore/update-notifier.js

HighShellbin/flowmind.js

HighRuntime Package Installbin/flowmind.js

MediumDynamic Requirecore/honor-engine.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdemo/common.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

core/update-notifier.jsView file

Lines 1-21javascript

1const { execFile, execSync } = require('child_process');

2const { promisify } = require('util');

High

Child Process

Package source references child process execution.

core/update-notifier.jsView on unpkg · L1

4function compareVersions(currentVersion, latestVersion) {

5 const current = parseVersion(currentVersion);

6 const latest = parseVersion(latestVersion);

8 for (let index = 0; index < 3; index += 1) {

9 if (latest[index] > current[index]) return -1;

10 if (latest[index] < current[index]) return 1;

11 }

13 return 0;

14}

16function parseVersion(version) {

17 return String(version || '0.0.0')

18 .split('.')

19 .slice(0, 3)

20 .map((part) => Number.parseInt(part, 10) || 0);

21}

bin/flowmind.jsView file

Lines 1571-1611javascript

1571

1572 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1573}

1574

1575function formatFileSize(bytes) {

1576 if (bytes === 0) return '0 B';

1577 const

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Lines 1741-1781javascript

1741 // Compare versions

1742 const parse = (v) => v.split('.').map(Number);

1743 const curr = parse(currentVersion);

1744 const latest = parse(latestVersion);

1745 const isNewer = latest[0] > curr[0] || (latest[0] === curr[0] && latest[1] > curr[1]) || (latest[0] === curr[0] && latest[1] === curr[1] && latest[2] > curr[2]);

1746

1747 if (!isNewer) {

1748 console.log(chalk.green('\n✓ You are on a newer version than npm latest.'));

1749 return;

1750 }

1751

1752 console.log(chalk.yellow(`\n⬆ Update available: ${currentVersion} → ${latestVersion}`));

1753

1754 if (options.check) {

1755 console.log(chalk.cyan('\nRun `flowmind update` to install.'));

1756 return;

1757 }

1758

1759 // Detect install method

1760 const isGlobal = (() => {

1761 try {

1762 const globalRoot = execSync('npm root -g', { encoding: 'utf-8' }).trim();

1763 const localPath = require.resolve('../package.json');

1764 return localPath.startsWith(globalRoot);

1765 } catch { return false; }

1766 })();

1767

1768 const installCmd = isGlobal

1769 ? `npm install -g flowmind@${latestVersion}`

1770 : `npm install flowmind@${latestVersion}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/flowmind.jsView on unpkg · L1761

1771

1772 console.log(chalk.cyan(`\nInstalling: ${installCmd}`));

1773 const spinner = ora('Updating FlowMind...').start();

1774

1775 try {

1776 execSync(installCmd, { encoding: 'utf-8', stdio: 'pipe' });

1777 spinner.succeed(`FlowMind updated to ${latestVersion}!`);

1778

1779 console.log(chalk.green('\n✓ Update complete!'));

1780 console.log(chalk.gray(' Run `flowmind --version` to verify.'));

1781 } catch (installError) {