registry / iclavue / 10.4.13

iclavue@10.4.13

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 857 KB of source, external domains: api.anthropic.com, api.kimi.com, api.minimaxi.com, gateway.example.com, json-schema.org, open.bigmodel.cn, openrouter.ai

Oversized source lightweight scan

dist/cli.js15.3 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsMinified

dist/openai-responses-adapter.js2.25 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsgateway.example.com

Source & flagged code

6 flagged

package.jsonView file

Lines 61-101json

61 "url": "git+https://github.com/mycode699/clavue.git"

62 },

63 "publishConfig": {

64 "access": "public"

65 },

66 "bundleDependencies": [

67 "@anthropic-ai/sandbox-runtime",

68 "@opentelemetry/api",

69 "@opentelemetry/api-logs",

70 "@opentelemetry/core",

71 "@opentelemetry/resources",

72 "@opentelemetry/sdk-logs",

73 "@opentelemetry/sdk-metrics",

74 "@opentelemetry/sdk-trace-base",

75 "@opentelemetry/semantic-conventions",

76 "ajv",

77 "lru-cache",

78 "qrcode"

79 ],

80 "scripts": {

81 "postinstall": "node scripts/postinstall-pager.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L81

82 "build": "npm run check:release && npm pack --dry-run",

83 "build:knowledge": "node scripts/build-project-knowledge.mjs",

84 "vendor:ripgrep": "node scripts/vendor-ripgrep.mjs",

85 "check": "npm run check:quick",

86 "check:fast": "npm run check:types && npm run check:source-purity && npm run check:boundaries && npm run test:fast && npm run check:startup",

87 "check:quick": "npm run validate:repo && npm run check:test-hygiene && npm run check:source-purity && npm run check:boundaries && npm run check:types && npm test && npm run check:test-hygiene && npm run check:pager-ui && npm run check:eval-baseline && npm run test:system-contract",

88 "check:release": "npm run vendor:ripgrep && npm run validate:repo && npm run check:test-hygiene && npm run verify:dist-clean && npm run verify:dist && npm run verify:source-build && npm run check:source-purity && npm run check:boundaries && npm run check:types && npm test && npm run check:test-hygiene && npm run check:flywheel",

89 "check:hygiene": "npm run validate:repo",

90 "check:test-hygiene": "node scripts/check-test-tmp-hygiene.mjs",

91 "test:clean-tmp": "node scripts/clean-test-tmp.mjs",

92 "check:source-purity": "node scripts/check-source-purity.mjs",

93 "check:boundaries": "node scripts/check-architecture-boundaries.mjs",

94 "check:commits": "node scripts/check-commit-message.mjs --range HEAD~1..HEAD",

95 "check:architecture-budget": "node scripts/check-architecture-budget.mjs",

96 "check:knip": "node scripts/check-knip-baseline.mjs",

97 "check:types": "node scripts/check-types.mjs",

98 "verify:source-build": "node scripts/build-plugin.mjs",

99 "verify:dist-clean": "node scripts/verify-dist-clean.mjs",

100 "rebuild:dist": "CLAVUE_BUILD_TARGET=dist node scripts/build-plugin.mjs && node scripts/build-pager-release.mjs",

101 "start": "node dist/clavue.js --version",

dist/provider-command.jsView file

Lines 907-947javascript

907 }

908 }

909 }

910

911 const savedProfile = saveProviderProfile(

912 createSavableCurrentProfile(currentProfile, targetName),

913 {

914 activate: true,

915 },

916

dist/native/clavue-pagerView file

•path = dist/native/clavue-pager kind = native_binary sizeBytes = 1581568 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pagerView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2361949 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 15997563 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/provider-command.jsView file

927L928: const importMatch = trimmedArgs.match(/^import(?:\s+(.+))?$/i) L929: if (importMatch) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/provider-command.jsView on unpkg · L927

dist/native/clavue-pagerView file

•path = dist/native/clavue-pager kind = native_binary sizeBytes = 1581568 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pagerView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2361949 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 15997563 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Findings

2 High7 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/openai-responses-adapter.js

MediumDynamic Requiredist/provider-command.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/native/clavue-pager

MediumShips Build Helperinstall.sh

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

package.jsonView file

Lines 61-101json

61 "url": "git+https://github.com/mycode699/clavue.git"

62 },

63 "publishConfig": {

64 "access": "public"

65 },

66 "bundleDependencies": [

67 "@anthropic-ai/sandbox-runtime",

68 "@opentelemetry/api",

69 "@opentelemetry/api-logs",

70 "@opentelemetry/core",

71 "@opentelemetry/resources",

72 "@opentelemetry/sdk-logs",

73 "@opentelemetry/sdk-metrics",

74 "@opentelemetry/sdk-trace-base",

75 "@opentelemetry/semantic-conventions",

76 "ajv",

77 "lru-cache",

78 "qrcode"

79 ],

80 "scripts": {

81 "postinstall": "node scripts/postinstall-pager.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L81

82 "build": "npm run check:release && npm pack --dry-run",

83 "build:knowledge": "node scripts/build-project-knowledge.mjs",

84 "vendor:ripgrep": "node scripts/vendor-ripgrep.mjs",

85 "check": "npm run check:quick",

86 "check:fast": "npm run check:types && npm run check:source-purity && npm run check:boundaries && npm run test:fast && npm run check:startup",

89 "check:hygiene": "npm run validate:repo",

90 "check:test-hygiene": "node scripts/check-test-tmp-hygiene.mjs",

91 "test:clean-tmp": "node scripts/clean-test-tmp.mjs",

92 "check:source-purity": "node scripts/check-source-purity.mjs",

93 "check:boundaries": "node scripts/check-architecture-boundaries.mjs",

94 "check:commits": "node scripts/check-commit-message.mjs --range HEAD~1..HEAD",

95 "check:architecture-budget": "node scripts/check-architecture-budget.mjs",

96 "check:knip": "node scripts/check-knip-baseline.mjs",

97 "check:types": "node scripts/check-types.mjs",

98 "verify:source-build": "node scripts/build-plugin.mjs",

99 "verify:dist-clean": "node scripts/verify-dist-clean.mjs",

100 "rebuild:dist": "CLAVUE_BUILD_TARGET=dist node scripts/build-plugin.mjs && node scripts/build-pager-release.mjs",

101 "start": "node dist/clavue.js --version",

dist/provider-command.jsView file

Lines 907-947javascript

907 }

908 }

909 }

910

911 const savedProfile = saveProviderProfile(

912 createSavableCurrentProfile(currentProfile, targetName),

913 {

914 activate: true,

915 },

916

dist/native/clavue-pagerView file

•path = dist/native/clavue-pager kind = native_binary sizeBytes = 1581568 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pagerView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2361949 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 15997563 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg