registry / jinzd-ai-cli / 0.4.249

jinzd-ai-cli@0.4.249

Cross-platform REPL-style AI CLI with multi-provider support

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 2.87 MB of source, external domains: 127.0.0.1, ai.dev, api.deepseek.com, api.minimaxi.com, api.moonshot.ai, api.openai.com, cn.bing.com, console.cloud.google.com, dashscope.aliyuncs.com, github.com, json.schemastore.org, mths.be, ollama.com, open.bigmodel.cn, openrouter.ai, programmablesearchengine.google.com, registry.npmjs.org, tailwindcss.com, twitter.com, www.googleapis.com

Source & flagged code

10 flagged

dist/chunk-3KVCJEOO.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2import {

3 evaluateCiGate,

4 normalizeCiThresholds

5} from "./chunk-DCOIW3XR.js";

6import {

7 buildReviewPrompt,

8 buildSecurityReviewPrompt,

9 truncateDiff

10} from "./chunk-HLWUDRBO.js";

11import {

12 ProviderRegistry

13} from "./chunk-2QZMITSL.js";

14import {

15 ConfigManager

16} from "./chunk-W4AHFL6E.js";

17import {

18 VERSION

19} from "./chunk-OLDX4A5Q.js";

21// src/cli/ci.ts

22import { execFileSync } from "child_process";

23var CI_COMMENT_MARKER = "";

High

Child Process

Package source references child process execution.

dist/chunk-3KVCJEOO.jsView on unpkg · L21

24function zeroSeverity() {

25 return { critical: 0, high: 0, warning: 0, info: 0 };

26}

27function earlyResult(exitCode, markdown, thresholds) {

28 const gate = evaluateCiGate(markdown, thresholds);

29 return {

30 exitCode: exitCode === 0 && gate.failed ? 1 : exitCode,

31 markdown,

32 posted: false,

33 severity: zeroSeverity(),

34 gate,

35 meta: { mode: "read-only", thresholds }

36 };

37}

38function fetchDiff(opts) {

39 if (opts.diffOverride != null) return opts.diffOverride;

40 if (opts.pr != null) {

41 try {

dist/electron-server.jsView file

High

Shell

Package source references shell execution.

dist/electron-server.jsView on unpkg · L762

116// 可选：直接在此写 key（也可通过 apiKeys 字段或环境变量提供） L117: baseUrl: z.string().max(2e3), L118: // OpenAI 兼容 API 的 base URL（必填） ... L535: try { L536: const raw = JSON.parse(readFileSync(this.configPath, "utf-8")); L537: return ConfigSchema.parse(raw); ... L4746: // src/tools/builtin/bash.ts L4747: import { spawn as spawn3 } from "child_process"; L4748: import { existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2 } from "fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/electron-server.jsView on unpkg · L116

91Detached bundled service listener: dist/electron-server.js launches a Node helper and exposes a broad-bound HTTP listener. L91: import express from "express"; L92: import { createServer } from "http"; L93: import { WebSocketServer } from "ws"; ... L283: denyPorts: z.array(z.number().int().min(1).max(65535)).default([]), L284: allowPrivateNetwork: z.boolean().default(false), L285: tools: z.object({ ... L437: if (fixedEnvVar && fixedEnvVar !== dynamicEnvVar) { L438: const fixedVal = process.env[fixedEnvVar]; L439: const dynVal = process.env[dynamicEnvVar]; L440: if (fixedVal && dynVal && fixedVal !== dynVal) { L441: process.stderr.write(`[warn] env var collision: ${fixedEnvVar} and ${dynamicEnvVar} have different values for provider "${providerId}". Using ${fixedEnvVar}. L442: `);

dist/web/client/vendor/tailwind.jsView file

Lines 1-21javascript

1(()=>{var qv=Object.create;var Hi=Object.defineProperty;var $v=Object.getOwnPropertyDescriptor;var Lv=Object.getOwnPropertyNames;var Mv=Object.getPrototypeOf,Nv=Object.prototype.hasOwnProperty;

dist/chunk-CKH4KQ4E.jsView file

Lines 32-72javascript

32 case "rs":

33 return "rust";

34 case "java":

35 return "java";

36 case

dist/chunk-54JJXHVI.jsView file

Lines 675-715javascript

675 }

676 /** 获取激活技能的 prompt 内容（null 表示无激活技能） */

677 getActivePromptContent() {

678 return this.activeSkill?.content ?? null;

679 }

680 /** 获取激活技能的工具白名单 Set（null 表示无限制） */

681

dist/wasm/tree-sitter-go.wasmView file

•path = dist/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter-go.wasmView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code