registry / gipity / 1.0.428

gipity@1.0.428

The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 1.23 MB of source, external domains: a.gipity.ai, aider.chat, dev.gipity.ai, gipity.ai, media.gipity.ai, prompt.gipity.ai, registry.npmjs.org, schemas.microsoft.com, www.apple.com

Oversized source lightweight scan

dist/index.js2.01 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

5 flagged

dist/updater/shim.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

5// src/platform.ts

6import { execSync, spawn, spawnSync } from "child_process";

7function resolveCommand(cmd) {

8 if (process.platform !== "win32") return cmd;

9 try {

10 const lines = execSync(`where ${cmd}`, { encoding: "utf-8", windowsHide: true }).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);

11 return lines.find((l) => l.endsWith(".exe")) || lines.find((l) => l.endsWith(".cmd")) || cmd;

12 } catch {

13 return `${cmd}.cmd`;

14 }

15}

16function isBatchShim(cmd) {

17 return process.platform === "win32" && /\.(cmd|bat)$/i.test(cmd);

18}

19function winBatchInvocation(cmd, args) {

20 const comspec = process.env.ComSpec || "cmd.exe";

21 const quote = (t) => `"${String(t).replace(/"/g, '""')}"`;

22 const line = [cmd, ...args].map(quote).join(" ");

dist/commands/uninstall.jsView file

Lines 7-47javascript

7 *

8 * Does not touch the npm-installed shim - the user removes that separately

9 * via `npm uninstall -g gipity`.

10 */

11import { Command } from 'commander';

12import { existsSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'fs';

dist/updater/check.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

5// src/updater/check.ts

6import { appendFileSync, existsSync as existsSync2 } from "fs";

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2107012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2107012 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/updater/shim.jsView file

2import { createRequire as __cliCreateRequire } from 'module'; L3: const require = __cliCreateRequire(import.meta.url); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

dist/commands/uninstall.jsView file

27function removeGipityPluginConfig() { L28: const settingsPath = join(homedir(), '.claude', 'settings.json'); L29: if (!existsSync(settingsPath)) ... L32: try { L33: settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); L34: } ... L65: const touched = []; L66: for (const name of ['.bashrc', '.zshrc', '.profile']) { L67: const rc = join(homedir(), name); ... L147: if (err instanceof UnsupportedPlatformError) L148: return { ran: false, ok: true, note: `Unsupported platform (${process.platform}) - nothing to uninstall.` }; L149: return { ran: false, ok: false, note: String(err) };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/uninstall.jsView on unpkg · L27

dist/updater/check.jsView file

11import { homedir } from "os"; L12: var GIPITY_DIR = join(homedir(), ".gipity"); L13: var LOCAL_DIR = join(GIPITY_DIR, "local"); ... L33: try { L34: return { ...DEFAULT_STATE, ...JSON.parse(readFileSync(STATE_FILE, "utf-8")) }; L35: } catch { ... L51: function updatesDisabled() { L52: if (process.env["DISABLE_AUTOUPDATER"] === "1") return { disabled: true, reason: "DISABLE_AUTOUPDATER=1" }; L53: if (process.env["CI"]) return { disabled: true, reason: "CI environment" }; ... L58: // src/platform.ts L59: import { execSync, spawn, spawnSync } from "child_process"; L60: function resolveCommand(cmd) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/updater/check.jsView on unpkg · L11

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2107012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2107012 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Findings

2 High6 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/updater/check.js

HighOversized Source Filedist/index.js

MediumDynamic Requiredist/updater/shim.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/uninstall.js

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/updater/shim.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/updater/shim.jsView on unpkg · L2

5// src/platform.ts

6import { execSync, spawn, spawnSync } from "child_process";

7function resolveCommand(cmd) {

8 if (process.platform !== "win32") return cmd;

9 try {

10 const lines = execSync(`where ${cmd}`, { encoding: "utf-8", windowsHide: true }).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);

11 return lines.find((l) => l.endsWith(".exe")) || lines.find((l) => l.endsWith(".cmd")) || cmd;

12 } catch {

13 return `${cmd}.cmd`;

14 }

15}

16function isBatchShim(cmd) {

17 return process.platform === "win32" && /\.(cmd|bat)$/i.test(cmd);

18}

19function winBatchInvocation(cmd, args) {

20 const comspec = process.env.ComSpec || "cmd.exe";

21 const quote = (t) => `"${String(t).replace(/"/g, '""')}"`;

22 const line = [cmd, ...args].map(quote).join(" ");

dist/commands/uninstall.jsView file

Lines 7-47javascript

7 *

8 * Does not touch the npm-installed shim - the user removes that separately

9 * via `npm uninstall -g gipity`.

10 */

11import { Command } from 'commander';

12import { existsSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'fs';

dist/updater/check.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { createRequire as __cliCreateRequire } from 'module';

3const require = __cliCreateRequire(import.meta.url);

5// src/updater/check.ts

6import { appendFileSync, existsSync as existsSync2 } from "fs";

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2107012 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2107012 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg