registry / incremnt / 0.8.9

incremnt@0.8.9

⚠ Under review

Command-line tool for querying your incremnt strength training data

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 1.35 MB of source, external domains: cloud.langfuse.com, fonts.googleapis.com, fonts.gstatic.com, incremnt-sync.onrender.com, incremnt.app, openrouter.ai, www.incremnt.app

Source & flagged code

2 flagged

package.jsonView file

Lines 16-56json

16 "SKILL.md",

17 "README.md"

18 ],

19 "scripts": {

20 "test": "node --test",

21 "test:evals": "node --test test/summary-evals.test.js",

22 "test:evals:real": "SUMMARY_EVAL_CASE_SET=anonymized-render node --test test/summary-evals.test.js",

23 "evals:stored": "node ./scripts/run-summary-evals.js",

24 "evals:stored:render": "node ./scripts/run-render-summary-evals.js",

25 "evals:promptfoo": "promptfoo eval -c promptfooconfig.yaml",

26 "evals:promptfoo:production-replay": "SUMMARY_EVAL_CASE_SET=production-replay promptfoo eval -c promptfooconfig.yaml",

27 "evals:promptfoo:live": "PROMPTFOO_LIVE=1 SUMMARY_EVALS_LIVE=1 promptfoo eval -c promptfooconfig.yaml",

28 "evals:ask-replay": "node ./scripts/run-ask-replay.js",

29 "evals:workout-bakeoff": "node ./scripts/run-workout-prompt-bakeoff.js",

30 "evals:coach-bakeoff": "node ./scripts/run-production-coach-bakeoff.js",

31 "evals:coach-replay": "node ./scripts/run-production-coach-replay.js",

32 "increment-score:replay": "node ./scripts/run-increment-score-replay.js",

33 "increment-score:replay-data": "node ./scripts/export-increment-score-replay-data.js",

34 "langfuse:smoke": "node ./scripts/smoke-langfuse-score.js",

35 "dev:sync-fixture": "node ./scripts/dev-sync-fixture-server.js",

36 "postinstall": "node -e \"process.stdout.write('\\n incremnt MCP server installed.\\n Run: incremnt mcp install\\n to register it with Claude and Codex.\\n\\n')\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L36

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "dependencies": {

39 "@langchain/core": "^1.2.0",

40 "@langchain/langgraph": "^1.4.4",

41 "@langfuse/tracing": "^5.2.0",

42 "@modelcontextprotocol/sdk": "^1.12.1",

43 "@opentelemetry/api": "^1.9.1",

44 "chalk": "^5.6.2",

45 "ink": "^7.0.1",

46 "openai": "^6.34.0",

47 "react": "^19.2.5",

48 "zod": "^4.3.6"

49 },

50 "devDependencies": {

51 "promptfoo": "^0.121.8"

52 },

53 "overrides": {

54 "mongodb": {

55 "gcp-metadata": "^8.1.2"

56 }

Source & flagged code

2 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code