registry / gipity / 1.0.409

gipity@1.0.409

⚠ Under review

The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 773 KB of source, external domains: a.gipity.ai, aider.chat, dev.gipity.ai, gipity.ai, media.gipity.ai, prompt.gipity.ai, registry.npmjs.org, schemas.microsoft.com, www.apple.com

Source & flagged code

2 flagged

dist/commands/credits.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawn } from 'node:child_process';

3import { get } from '../api.js';

4import { brand, muted } from '../colors.js';

5import { run, printList } from '../helpers/index.js';

6const PRICING_URL = 'https://prompt.gipity.ai/pricing';

7function openInBrowser(url) {

8 // Windows `start` is a cmd.exe builtin, not an executable - spawn can't

9 // launch it directly, so go through `cmd /c start`. The empty "" is the

10 // window-title arg; without it a quoted URL would be swallowed as the title.

11 const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] :

12 process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] :

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/credits.jsView on unpkg · L1

13 ['xdg-open', [url]];

14 try {

15 const child = spawn(cmd, args, { stdio: 'ignore', detached: true });

16 // A missing/non-executable launcher (ENOENT, or EACCES on WSL/minimal Linux

17 // where xdg-open isn't runnable) is reported ASYNCHRONOUSLY via an 'error'

18 // event - not a throw - so the try/catch alone can't stop it. With no

19 // listener Node escalates it to an unhandled 'error' and crashes the whole

20 // process. Swallow it; the caller already printed the URL as the fallback.

21 child.on('error', () => { });

dist/commands/job.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gipity@1.0.408 matchedIdentity = npm:Z2lwaXR5:1.0.408 similarity = 0.859 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/job.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/commands/credits.jsView file

1import { Command } from 'commander'; L2: import { spawn } from 'node:child_process'; L3: import { get } from '../api.js'; ... L5: import { run, printList } from '../helpers/index.js'; L6: const PRICING_URL = 'https://prompt.gipity.ai/pricing'; L7: function openInBrowser(url) { L8: // Windows `start` is a cmd.exe builtin, not an executable - spawn can't L9: // launch it directly, so go through `cmd /c start`. The empty "" is the L10: // window-title arg; without it a quoted URL would be swallowed as the title. L11: const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : L12: process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] :

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/credits.jsView on unpkg · L1

dist/commands/job.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/job.jsView on unpkg

Findings

1 Critical1 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/job.js

HighSandbox Evasion Gated Capabilitydist/commands/credits.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/credits.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawn } from 'node:child_process';

3import { get } from '../api.js';

4import { brand, muted } from '../colors.js';

5import { run, printList } from '../helpers/index.js';

6const PRICING_URL = 'https://prompt.gipity.ai/pricing';

7function openInBrowser(url) {

8 // Windows `start` is a cmd.exe builtin, not an executable - spawn can't

9 // launch it directly, so go through `cmd /c start`. The empty "" is the

10 // window-title arg; without it a quoted URL would be swallowed as the title.

11 const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] :

12 process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] :

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/credits.jsView on unpkg · L1

13 ['xdg-open', [url]];

14 try {

15 const child = spawn(cmd, args, { stdio: 'ignore', detached: true });

16 // A missing/non-executable launcher (ENOENT, or EACCES on WSL/minimal Linux

17 // where xdg-open isn't runnable) is reported ASYNCHRONOUSLY via an 'error'

18 // event - not a throw - so the try/catch alone can't stop it. With no

19 // listener Node escalates it to an unhandled 'error' and crashes the whole

20 // process. Swallow it; the caller already printed the URL as the fallback.

21 child.on('error', () => { });

dist/commands/job.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/job.jsView on unpkg