registry / helixcoder / 0.1.0

helixcoder@0.1.0

Helix: a free, headless AI software-engineering agent and CLI. Runs a grounded loop (gather, act, verify, iterate) with permission-gated tools, snapshots, a per-task cost meter, and an eval harness. BYOK, provider-agnostic (Anthropic, Gemini, OpenAI-compa

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 621 KB of source, external domains: api.cerebras.ai, api.groq.com, api.openai.com, console.groq.com, generativelanguage.googleapis.com, helix.dev, json-schema.org, openrouter.ai

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 2039-2079javascript

2039 }

2040 }

2041 throw err;

2042 }

2043 }

2044 async *stream(req) {

2045 const response = await this.generate(req);

2046 if (response.text)

2047 yield { type: "text_delta", text: response.text, index: 0 };

2048 for (const tool_call of response.tool_calls)

2049 yield { type: "tool_call", tool_call };

2050 yield { type: "done", response };

2051 }

2052};

2053function createOpenAiProvider(opts = {}) {

2054 const env = opts.env ?? process.env;

2055 const apiKey = opts.apiKey ?? env.OPENAI_API_KEY;

2056 if (!apiKey) {

2057 throw new Error("createOpenAiProvider: no API key (set OPENAI_API_KEY or pass apiKey)");

2058 }

2059 const fetchImpl = opts.fetchImpl ?? fetch;

2060 const baseURL = (opts.baseURL ?? env.OPENAI_BASE_URL ?? DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, "");

2061 let parsedScheme;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.jsView on unpkg · L2059

2062 try {

2063 parsedScheme = new URL(`${baseURL}/chat/completions`).protocol;

2064 } catch {

2065 throw new Error(`createOpenAiProvider: invalid base URL (not a parseable URL): ${baseURL}`);

2066 }

2067 if (parsedScheme !== "http:" && parsedScheme !== "https:") {

2068 throw new Error(`createOpenAiProvider: base URL must be http: or https: (got ${parsedScheme}); egress carries your Bearer key, so only http(s) hosts are allowed`);

2069 }

2070 const client = {

2071 createChatCompletion: async (params) => {

2072 const res = await withRetry(() => fetchImpl(`${baseURL}/chat/completions`, {

2073 method: "POST",

2074 headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },

2075 body: JSON.stringify(params),

2076 redirect: "error"

2077 }), opts.retry);

2078 if (!res.ok) {

2079 const detail = await res.text().catch(() => "");

Lines 2384-2424javascript

2384 return realAbs;

2385}

2386function contained(abs, root, realRoot, platform = process.platform) {

2387 const target = resolve(abs);

2388 const rel = relative(root, target);

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

Source & flagged code

3 flagged · loading source

dist/bin.jsView file

2404// ../engine/dist/command-verifier.js L2405: import { spawn } from "node:child_process"; L2406: import { StringDecoder } from "node:string_decoder";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L2404

2059const fetchImpl = opts.fetchImpl ?? fetch; L2060: const baseURL = (opts.baseURL ?? env.OPENAI_BASE_URL ?? DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, ""); L2061: let parsedScheme; ... L2404: // ../engine/dist/command-verifier.js L2405: import { spawn } from "node:child_process"; L2406: import { StringDecoder } from "node:string_decoder"; ... L2841: const mk = async (wasm) => { L2842: const lang = await Parser.Language.load(readFileSync(vendorWasm(wasm))); L2843: const p = new Parser();

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.jsView on unpkg · L2059

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

Findings

3 High3 Medium6 Low

HighChild Processdist/bin.js

HighShell

HighRemote Agent Bridgedist/bin.js

MediumEnvironment Vars

MediumShips Wasm Modulevendor/tree-sitter/tree-sitter.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 2039-2079javascript

2039 }

2040 }

2041 throw err;

2042 }

2043 }

2044 async *stream(req) {

2045 const response = await this.generate(req);

2046 if (response.text)

2047 yield { type: "text_delta", text: response.text, index: 0 };

2048 for (const tool_call of response.tool_calls)

2049 yield { type: "tool_call", tool_call };

2050 yield { type: "done", response };

2051 }

2052};

2053function createOpenAiProvider(opts = {}) {

2054 const env = opts.env ?? process.env;

2055 const apiKey = opts.apiKey ?? env.OPENAI_API_KEY;

2056 if (!apiKey) {

2057 throw new Error("createOpenAiProvider: no API key (set OPENAI_API_KEY or pass apiKey)");

2058 }

2059 const fetchImpl = opts.fetchImpl ?? fetch;

2060 const baseURL = (opts.baseURL ?? env.OPENAI_BASE_URL ?? DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, "");

2061 let parsedScheme;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin.jsView on unpkg · L2059

2062 try {

2063 parsedScheme = new URL(`${baseURL}/chat/completions`).protocol;

2064 } catch {

2065 throw new Error(`createOpenAiProvider: invalid base URL (not a parseable URL): ${baseURL}`);

2066 }

2067 if (parsedScheme !== "http:" && parsedScheme !== "https:") {

2068 throw new Error(`createOpenAiProvider: base URL must be http: or https: (got ${parsedScheme}); egress carries your Bearer key, so only http(s) hosts are allowed`);

2069 }

2070 const client = {

2071 createChatCompletion: async (params) => {

2072 const res = await withRetry(() => fetchImpl(`${baseURL}/chat/completions`, {

2073 method: "POST",

2074 headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },

2075 body: JSON.stringify(params),

2076 redirect: "error"

2077 }), opts.retry);

2078 if (!res.ok) {

2079 const detail = await res.text().catch(() => "");

Lines 2384-2424javascript

2384 return realAbs;

2385}

2386function contained(abs, root, realRoot, platform = process.platform) {

2387 const target = resolve(abs);

2388 const rel = relative(root, target);

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 188635 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg