registry / gsd-lite / 0.8.5

gsd-lite@0.8.5

⚠ Under review

AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core

Static Scan Results

scanned 2m ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 302 KB of source, external domains: api.github.com

Source & flagged code

5 flagged

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// Plugin installer for GSD-Lite

4import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync, renameSync, rmSync, readdirSync } from 'node:fs';

5import { join, dirname } from 'node:path';

6import { homedir } from 'node:os';

7import { fileURLToPath, pathToFileURL } from 'node:url';

8import { execSync } from 'node:child_process';

9import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

install.jsView on unpkg · L7

11const __dirname = dirname(fileURLToPath(import.meta.url));

12const _require = createRequire(import.meta.url);

13const { semverSortComparator } = _require('./hooks/lib/semver-sort.cjs');

14const { isCompositeStatusLine, registerProvider: registerCompositeProvider } = _require('./hooks/lib/statusline-composite.cjs');

15const CLAUDE_DIR = process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');

16const RUNTIME_DIR = join(CLAUDE_DIR, 'gsd');

17const DRY_RUN = process.argv.includes('--dry-run');

19// Single source of truth for hook files (used by copy loop and registration)

20const HOOK_FILES = ['gsd-session-init.cjs', 'gsd-auto-update.cjs', 'gsd-context-monitor.cjs', 'gsd-statusline.cjs', 'gsd-session-stop.cjs'];

22// Hook registration config: hookType → { file identifier, matcher, timeout? }

23const HOOK_REGISTRY = [

24 { hookType: 'SessionStart', identifier: 'gsd-session-init', matcher: 'startup|clear|compact', timeout: 5 },

25 { hookType: 'PostToolUse', identifier: 'gsd-context-monitor', matcher: '*' },

26 { hookType: 'Stop', identifier: 'gsd-session-stop', matcher: '*', timeout: 3 },

27];

Lines 195-235javascript

195 } else {

196 for (const [sub, label] of userScopeCopies) {

197 copyDir(join(__dirname, sub), join(CLAUDE_DIR, sub, 'gsd'), label);

198 }

199 }

200

201 // 5. Hooks (copy scripts only, skip hooks.json to avoid overwriting other plugins)

202

hooks/gsd-statusline.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// GSD-Lite StatusLine hook

3// Shows: model | current task | directory | context usage progress bar

4// Reads JSON from stdin, writes bridge file for context-monitor PostToolUse hook.

6const fs = require('node:fs');

7const path = require('node:path');

hooks/gsd-auto-update.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = gsd-lite@0.8.3 matchedIdentity = npm:Z3NkLWxpdGU:0.8.3 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/gsd-auto-update.cjsView on unpkg

Source & flagged code

5 flagged · loading source

install.jsView file

7import { fileURLToPath, pathToFileURL } from 'node:url'; L8: import { execSync } from 'node:child_process'; L9: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

install.jsView on unpkg · L7

215// the runtime). Leaving them in means a later manual `npm install` in L216: // ~/.claude/gsd fails under cmd.exe on Windows (issue #2). L217: if (DRY_RUN) {

High

Shell

Package source references shell execution.

install.jsView on unpkg · L215

215// the runtime). Leaving them in means a later manual `npm install` in L216: // ~/.claude/gsd fails under cmd.exe on Windows (issue #2). L217: if (DRY_RUN) { ... L230: copyFile(join(__dirname, 'uninstall.js'), join(RUNTIME_DIR, 'uninstall.js'), 'runtime/uninstall.js → ~/.claude/gsd/uninstall.js'); L231: // Copy lock file so `npm ci` works when node_modules are not present (npx scenario) L232: const lockFile = join(__dirname, 'package-lock.json');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L215

hooks/gsd-statusline.cjsView file

5L6: const fs = require('node:fs'); L7: const path = require('node:path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/gsd-statusline.cjsView on unpkg · L5

hooks/gsd-auto-update.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/gsd-auto-update.cjsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltahooks/gsd-auto-update.cjs

HighChild Processinstall.js

HighShellinstall.js

HighRuntime Package Installinstall.js

MediumDynamic Requirehooks/gsd-statusline.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// Plugin installer for GSD-Lite

4import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync, renameSync, rmSync, readdirSync } from 'node:fs';

5import { join, dirname } from 'node:path';

6import { homedir } from 'node:os';

7import { fileURLToPath, pathToFileURL } from 'node:url';

8import { execSync } from 'node:child_process';

9import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

install.jsView on unpkg · L7

11const __dirname = dirname(fileURLToPath(import.meta.url));

12const _require = createRequire(import.meta.url);

13const { semverSortComparator } = _require('./hooks/lib/semver-sort.cjs');

14const { isCompositeStatusLine, registerProvider: registerCompositeProvider } = _require('./hooks/lib/statusline-composite.cjs');

15const CLAUDE_DIR = process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');

16const RUNTIME_DIR = join(CLAUDE_DIR, 'gsd');

17const DRY_RUN = process.argv.includes('--dry-run');

19// Single source of truth for hook files (used by copy loop and registration)

20const HOOK_FILES = ['gsd-session-init.cjs', 'gsd-auto-update.cjs', 'gsd-context-monitor.cjs', 'gsd-statusline.cjs', 'gsd-session-stop.cjs'];

22// Hook registration config: hookType → { file identifier, matcher, timeout? }

23const HOOK_REGISTRY = [

24 { hookType: 'SessionStart', identifier: 'gsd-session-init', matcher: 'startup|clear|compact', timeout: 5 },

25 { hookType: 'PostToolUse', identifier: 'gsd-context-monitor', matcher: '*' },

26 { hookType: 'Stop', identifier: 'gsd-session-stop', matcher: '*', timeout: 3 },

27];

Lines 195-235javascript

195 } else {

196 for (const [sub, label] of userScopeCopies) {

197 copyDir(join(__dirname, sub), join(CLAUDE_DIR, sub, 'gsd'), label);

198 }

199 }

200

201 // 5. Hooks (copy scripts only, skip hooks.json to avoid overwriting other plugins)

202

hooks/gsd-statusline.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// GSD-Lite StatusLine hook

3// Shows: model | current task | directory | context usage progress bar

4// Reads JSON from stdin, writes bridge file for context-monitor PostToolUse hook.

6const fs = require('node:fs');

7const path = require('node:path');

hooks/gsd-auto-update.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/gsd-auto-update.cjsView on unpkg