registry / gipity / 1.1.1

gipity@1.1.1

The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 123 file(s), 1.40 MB of source, external domains: a.gipity.ai, aider.chat, dev.gipity.ai, gipity.ai, github.com, grok.x.ai, media.gipity.ai, prompt.gipity.ai, registry.npmjs.org, schemas.microsoft.com, www.apple.com

Oversized source lightweight scan

dist/index.js2.07 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

7 flagged

dist/commands/page-eval.jsView file

Lines 137-177javascript

137export const WAIT_FOR_MAX_MS = 30_000;

138/** Parse --wait-timeout, clamping to the gate's server-side ceiling. Over the cap

139 * the server answers with a zod 400 that names neither the flag nor the limit, so

140 * clamp and say so on stderr (--json stdout stays clean). Exported for tests. */

141export function capWaitForTimeoutMs(raw) {

142 const parsed = parseInt(raw, 10);

143 const ms = Number.isFinite(parsed) && parsed >= 0 ? parsed : 5_000;

144 if (ms <= WAIT_FOR_MAX_MS)

145 return ms;

146 console.error(warning(`--wait-timeout ${ms}ms exceeds the ${WAIT_FOR_MAX_MS}ms cap on the selector gate — using ${WAIT_FOR_MAX_MS}ms. ` +

147 `A state that takes longer than that to appear is not a settling delay: have the page reach it on load, ` +

148 `or watch for it INSIDE the script (--timeout ${EVAL_SCRIPT_BUDGET_MAX_MS}).`));

149 return WAIT_FOR_MAX_MS;

150}

151/** True when `s` is an expression (`document.title`, an IIFE) rather than a

152 * statement body (`const x = …; return x`). Mirrors the server's own parse

153 * choice: only an expression may be spliced into `return (…)`. Nothing is

154 * executed — Function() parses and throws on a statement body. */

155export function parsesAsExpression(s) {

156 try {

157 // eslint-disable-next-line no-new-func

158 new Function(`return (${s}\n);`);

159 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/page-eval.jsView on unpkg · L157

160 }

161 catch {

162 return false;

163 }

164}

165/** Prepend a prelude (fixture bindings, a post-gate settle) to a caller script.

166 * A prelude makes the whole thing a statement body, so an expression script has

167 * to become `return (expr)` — a statement-body script is spliced as-is. */

168export function withPrelude(script, prelude) {

169 if (!prelude)

170 return script;

171 return parsesAsExpression(script)

172 ? `${prelude}\nreturn (${script});`

173 : `${prelude}\n${script}`;

174}

175// A camera app's first useful frame is never 500ms away: getUserMedia has to

176// come up, then the vision pipeline downloads and initializes its model (WASM +

177// weights) before it can label anything. Evaluating at the default --wait always

dist/updater/shim.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

5// src/platform.ts

dist/commands/uninstall.jsView file

Lines 7-47javascript

7 *

8 * Does not touch the npm-installed shim - the user removes that separately

9 * via `npm uninstall -g gipity`.

10 */

11import { Command } from 'commander';

12import { existsSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'fs';

dist/updater/check.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

5// src/updater/check.ts

6import { appendFileSync, existsSync as existsSync2 } from "fs";

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2170613 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2170613 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

dist/commands/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gipity@1.0.429 matchedIdentity = npm:Z2lwaXR5:1.0.429 similarity = 0.832 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/build.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/commands/page-eval.jsView file

157// eslint-disable-next-line no-new-func L158: new Function(`return (${s}\n);`); L159: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/page-eval.jsView on unpkg · L157

dist/updater/shim.jsView file

2import { createRequire as __cliCreateRequire } from 'module'; L3: const require = __cliCreateRequire(import.meta.url); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

dist/commands/uninstall.jsView file

27function removeGipityPluginConfig() { L28: const settingsPath = join(homedir(), '.claude', 'settings.json'); L29: if (!existsSync(settingsPath)) ... L32: try { L33: settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); L34: } ... L65: const touched = []; L66: for (const name of ['.bashrc', '.zshrc', '.profile']) { L67: const rc = join(homedir(), name); ... L147: if (err instanceof UnsupportedPlatformError) L148: return { ran: false, ok: true, note: `Unsupported platform (${process.platform}) - nothing to uninstall.` }; L149: return { ran: false, ok: false, note: String(err) };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/uninstall.jsView on unpkg · L27

dist/updater/check.jsView file

11import { homedir } from "os"; L12: var GIPITY_DIR = join(homedir(), ".gipity"); L13: var LOCAL_DIR = join(GIPITY_DIR, "local"); ... L33: try { L34: return { ...DEFAULT_STATE, ...JSON.parse(readFileSync(STATE_FILE, "utf-8")) }; L35: } catch { ... L51: function updatesDisabled() { L52: if (process.env["DISABLE_AUTOUPDATER"] === "1") return { disabled: true, reason: "DISABLE_AUTOUPDATER=1" }; L53: if (process.env["CI"]) return { disabled: true, reason: "CI environment" }; ... L58: // src/platform.ts L59: import { execSync, spawn, spawnSync } from "child_process"; L60: function resolveCommand(cmd) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/updater/check.jsView on unpkg · L11

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2170613 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2170613 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

dist/commands/build.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/build.jsView on unpkg

Findings

3 High6 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/updater/check.js

HighOversized Source Filedist/index.js

HighPrevious Version Dangerous Deltadist/commands/build.js

MediumDynamic Requiredist/updater/shim.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/uninstall.js

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/commands/page-eval.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/commands/page-eval.jsView file

Lines 137-177javascript

137export const WAIT_FOR_MAX_MS = 30_000;

138/** Parse --wait-timeout, clamping to the gate's server-side ceiling. Over the cap

139 * the server answers with a zod 400 that names neither the flag nor the limit, so

140 * clamp and say so on stderr (--json stdout stays clean). Exported for tests. */

141export function capWaitForTimeoutMs(raw) {

142 const parsed = parseInt(raw, 10);

143 const ms = Number.isFinite(parsed) && parsed >= 0 ? parsed : 5_000;

144 if (ms <= WAIT_FOR_MAX_MS)

145 return ms;

146 console.error(warning(`--wait-timeout ${ms}ms exceeds the ${WAIT_FOR_MAX_MS}ms cap on the selector gate — using ${WAIT_FOR_MAX_MS}ms. ` +

147 `A state that takes longer than that to appear is not a settling delay: have the page reach it on load, ` +

148 `or watch for it INSIDE the script (--timeout ${EVAL_SCRIPT_BUDGET_MAX_MS}).`));

149 return WAIT_FOR_MAX_MS;

150}

151/** True when `s` is an expression (`document.title`, an IIFE) rather than a

152 * statement body (`const x = …; return x`). Mirrors the server's own parse

153 * choice: only an expression may be spliced into `return (…)`. Nothing is

154 * executed — Function() parses and throws on a statement body. */

155export function parsesAsExpression(s) {

156 try {

157 // eslint-disable-next-line no-new-func

158 new Function(`return (${s}\n);`);

159 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/page-eval.jsView on unpkg · L157

160 }

161 catch {

162 return false;

163 }

164}

165/** Prepend a prelude (fixture bindings, a post-gate settle) to a caller script.

166 * A prelude makes the whole thing a statement body, so an expression script has

167 * to become `return (expr)` — a statement-body script is spliced as-is. */

168export function withPrelude(script, prelude) {

169 if (!prelude)

170 return script;

171 return parsesAsExpression(script)

172 ? `${prelude}\nreturn (${script});`

173 : `${prelude}\n${script}`;

174}

175// A camera app's first useful frame is never 500ms away: getUserMedia has to

176// come up, then the vision pipeline downloads and initializes its model (WASM +

177// weights) before it can label anything. Evaluating at the default --wait always

dist/updater/shim.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

5// src/platform.ts

dist/commands/uninstall.jsView file

Lines 7-47javascript

7 *

8 * Does not touch the npm-installed shim - the user removes that separately

9 * via `npm uninstall -g gipity`.

10 */

11import { Command } from 'commander';

12import { existsSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'fs';

dist/updater/check.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

5// src/updater/check.ts

6import { appendFileSync, existsSync as existsSync2 } from "fs";

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2170613 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2170613 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

dist/commands/build.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/build.jsView on unpkg