ft-scout@3.0.7
⚠ Under reviewFrontTerrain — The Onboarding Co-Pilot for New Codebases
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedbin/src/utils/updateCheck.jsView file
5import { confirm, spinner, note } from '@clack/prompts';
L6: import { execSync } from 'child_process';
L7: const CACHE_FILE = path.join(os.homedir(), '.scout-update-cache.json');
High
Child Process
Package source references child process execution.
bin/src/utils/updateCheck.jsView on unpkg · L584try {
L85: execSync('npm install -g ft-scout', { stdio: 'pipe' });
L86: s.stop(chalk.green(`Successfully upgraded FrontTerrain Scout to v${latestVersion}! 🎉`));
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/src/utils/updateCheck.jsView on unpkg · L84bin/src/commands/agent.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = ft-scout@3.0.8
matchedIdentity = npm:ZnQtc2NvdXQ:3.0.8
similarity = 0.923
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltabin/src/commands/agent.js
HighChild Processbin/src/utils/updateCheck.js
HighShellbin/src/commands/agent.js
HighSandbox Evasion Gated Capabilitybin/src/commands/setup.js
HighRuntime Package Installbin/src/utils/updateCheck.js
HighShips High Entropy Blobfront-terrain-cli-1.0.0.tgz
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobfront-terrain-cli-1.0.0.tgz
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to ft-scout@3.0.7.
See all versions of ft-scout for other recorded verdicts.
- Review the evidence and your use of ft-scout@3.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.