registry / forgeai-agentic-init / 3.1.0

forgeai-agentic-init@3.1.0

AI project initialization kit for agentic coding workflows.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 141 KB of source, external domains: pypi.org, registry.npmjs.org, registry.yarnpkg.com, rubygems.org

Source & flagged code

2 flagged

dist/ui/pipe.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import fs, { constants } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/pipe.jsView on unpkg · L1

3import net from 'node:net';

4import readline from 'node:readline';

5const DEFAULT_PIPE = '.forgeai.pipe';

6export function getPipePath() {

7 return process.env['FORGEAI_PIPE'] ?? DEFAULT_PIPE;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ui/pipe.jsView on unpkg · L1

9export function createPipeReader(pipePath, onLine, onError) {

10 try {

11 execFileSync('mkfifo', [pipePath]);

12 }

13 catch {

14 // FIFO already exists — ok

15 }

16 // O_RDWR: TUI holds both read and write ends open.

17 // This prevents EOF when individual --emit writers disconnect.

18 // O_NONBLOCK: required so net.Socket (kqueue-based) can be used instead of

19 // fs.createReadStream (thread-pool-based). Using the thread pool causes

20 // fs.closeSync to block at cleanup when a read() is pending.

21 const fd = fs.openSync(pipePath, constants.O_RDWR | constants.O_NONBLOCK);

Source & flagged code

2 flagged · loading source

dist/ui/pipe.jsView file

1import { execFileSync } from 'node:child_process'; L2: import fs, { constants } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/pipe.jsView on unpkg · L1

1import { execFileSync } from 'node:child_process'; L2: import fs, { constants } from 'node:fs'; L3: import net from 'node:net'; L4: import readline from 'node:readline'; ... L6: export function getPipePath() { L7: return process.env['FORGEAI_PIPE'] ?? DEFAULT_PIPE; L8: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ui/pipe.jsView on unpkg · L1

Findings

3 High1 Medium4 Low

HighChild Processdist/ui/pipe.js

HighShell

HighSame File Env Network Executiondist/ui/pipe.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/ui/pipe.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import fs, { constants } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/pipe.jsView on unpkg · L1

3import net from 'node:net';

4import readline from 'node:readline';

5const DEFAULT_PIPE = '.forgeai.pipe';

6export function getPipePath() {

7 return process.env['FORGEAI_PIPE'] ?? DEFAULT_PIPE;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ui/pipe.jsView on unpkg · L1

9export function createPipeReader(pipePath, onLine, onError) {

10 try {

11 execFileSync('mkfifo', [pipePath]);

12 }

13 catch {

14 // FIFO already exists — ok

15 }

16 // O_RDWR: TUI holds both read and write ends open.

17 // This prevents EOF when individual --emit writers disconnect.

18 // O_NONBLOCK: required so net.Socket (kqueue-based) can be used instead of

19 // fs.createReadStream (thread-pool-based). Using the thread pool causes

20 // fs.closeSync to block at cleanup when a read() is pending.

21 const fd = fs.openSync(pipePath, constants.O_RDWR | constants.O_NONBLOCK);