registry / iclavue / 10.5.18

iclavue@10.5.18

Clavue: execution-first AI coding CLI with direct repo tools, provider routing, native workflows, MCP integration, and long-session recovery

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 857 KB of source, external domains: api.anthropic.com, api.kimi.com, api.minimaxi.com, gateway.example.com, json-schema.org, open.bigmodel.cn, openrouter.ai

Oversized source lightweight scan

dist/cli.js15.9 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsMinified

dist/openai-responses-adapter.js2.26 MB file, sampled 256 KB

ChildProcessEnvironmentVarsHighEntropyStringsMinified

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/provider-command.jsView file

927L928: const importMatch = trimmedArgs.match(/^import(?:\s+(.+))?$/i) L929: if (importMatch) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/provider-command.jsView on unpkg · L927

dist/native/clavue-pager-win32-x64.exeView file

•path = dist/native/clavue-pager-win32-x64.exe kind = native_binary sizeBytes = 4304007 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-win32-x64.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6417 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/openai-responses-adapter.jsView file

•path = dist/openai-responses-adapter.js kind = oversized_source_file sizeBytes = 2365646 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/openai-responses-adapter.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 16633087 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/provider-command.jsView file

927L928: const importMatch = trimmedArgs.match(/^import(?:\s+(.+))?$/i) L929: if (importMatch) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/provider-command.jsView on unpkg · L927

dist/native/clavue-pager-win32-x64.exeView file

•path = dist/native/clavue-pager-win32-x64.exe kind = native_binary sizeBytes = 4304007 magicHex = [redacted]

Findings

2 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/openai-responses-adapter.js

MediumDynamic Requiredist/provider-command.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/native/clavue-pager-win32-x64.exe

MediumShips Build Helperinstall.sh

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to iclavue@10.5.18.

See all versions of iclavue for other recorded verdicts.

Review the evidence and your use of iclavue@10.5.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-14 12:42:06.688Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.