registry / idea-gauntlet / 0.7.0

idea-gauntlet@0.7.0

⚠ Under review

Stress-test product ideas with adversarial agents, synthetic users, and court-style critique.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 568 KB of source, external domains: api.anthropic.com, api.github.com, api.groq.com, api.openai.com, cdn.jsdelivr.net, fonts.googleapis.com, fonts.gstatic.com, hn.algolia.com, html.duckduckgo.com, news.ycombinator.com, registry.npmjs.org, www.producthunt.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "idea-gauntlet": "dist/cli/index.js"

8 },

9 "exports": {

10 ".": {

11 "import": "./dist/index.js",

12 "types": "./dist/index.d.ts"

13 },

14 "./cli": {

15 "import": "./dist/cli/index.js",

16 "types": "./dist/cli/index.d.ts"

17 }

18 },

19 "files": [

20 "dist",

21 "README.md",

22 "LICENSE"

23 ],

24 "scripts": {

25 "postinstall": "node -e \"try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 "build": "tsup src/index.ts src/cli/index.ts src/postinstall.ts --format esm --dts --clean",

27 "dev": "tsx src/cli/index.ts",

28 "start": "node dist/cli/index.js",

29 "test": "vitest run",

30 "test:watch": "vitest",

31 "typecheck": "tsc --noEmit",

32 "lint": "eslint src/ --ext .ts",

33 "lint:fix": "eslint src/ --ext .ts --fix",

34 "format": "prettier --write src/",

35 "prepublishOnly": "npm run build"

36 },

37 "keywords": [

38 "product-discovery",

39 "validation",

40 "adversarial",

41 "startup",

42 "idea"

43 ],

44 "license": "MIT",

45 "author": "Thuong180702 (https://github.com/Thuong180702)",

dist/cli/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { createInterface } from "readline/promises"; console.log("\n\u26A0 No API key or provider configured."); console.log(" 2) Configure API key now"); baseUrl: options.baseUrl, const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout }); const key = await rl.question("Enter API key: "); baseUrl: options.baseUrl, baseUrl: options.baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.js: import { mkdirSync, writeFileSync, existsSync } from "fs"; if (!existsSync(ideaFile)) writeFileSync(ideaFile, IDEA_TEMPLATE, "utf-8"); if (!existsSync(configFile)) writeFileSync(configFile, CONFIG_TEMPLATE, "utf-8"); writeFileSync(resolve(dir, "ideas", "my-idea.md"), IDEA_TEMPLATE, "utf-8"); writeFileSync(resolve(dir, "config.json"), CONFIG_TEMPLATE, "utf-8"); const res = await fetch("https://html.duckduckgo.com/html/?q=test", { import { readFileSync as readFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs"; writeFileSync2(filepath, generateHtmlReport2(r.report), "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.jsView on unpkg

dist/chunk-A6JBYWQ5.jsView file

Lines 1-34javascript

1import {

2 warnIfError

3} from "./chunk-ZGH4NLTD.js";

5// src/search/types.ts

6var DEFAULT_SEARCH_CONFIG = {

7 provider: "duckduckgo",

dist/chunk-3PLCSVJ5.jsView file

Lines 1-28javascript

1import {

2 getWorkflow

3} from "./chunk-EMIO7C42.js";

4import {

5 warnIfError

6} from "./chunk-ZGH4NLTD.js";

8// src/setup/globalSetup.ts

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code