registry / kcgrouter / 0.6.5

kcgrouter@0.6.5

Lightweight AI proxy gateway — route chat completions to upstream providers

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 204 file(s), 1.73 MB of source, external domains: api.anthropic.com, api.commandcode.ai, api.openai.com, api.xiaomimimo.com, api2.qoder.sh, api3.qoder.sh, bit.ly, codewhisperer.us-east-1.amazonaws.com, generativelanguage.googleapis.com, github.com, openapi.qoder.sh, q.us-east-1.amazonaws.com, qoder.com, react.dev, redux-toolkit.js.org, redux.js.org, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 17-57json

17 "bunfig.toml",

18 "tsconfig.json",

19 "!src/**/__tests__/**",

20 "!src/**/*.test.ts",

21 "!src/**/*.test.tsx",

22 "!src/test-setup.ts"

23 ],

24 "engines": {

25 "bun": ">=1.2.3"

26 },

27 "scripts": {

28 "dev": "bun --hot src/index.ts",

29 "start": "NODE_ENV=production bun src/index.ts",

30 "build": "bun run build.ts",

31 "check": "biome check --write ./src",

32 "lint": "biome lint --write ./src",

33 "format": "biome format --write ./src",

34 "gen-env": "bash scripts/gen-env.sh",

35 "generate-icon": "bun scripts/generate-icon.ts",

36 "test": "bash scripts/test.sh",

37 "postinstall": "bun scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepublishOnly": "bun run build"

39 },

40 "dependencies": {

41 "@clack/prompts": "^1.7.0",

42 "@radix-ui/react-label": "^2.1.7",

43 "@radix-ui/react-select": "^2.2.6",

44 "@radix-ui/react-slot": "^1.2.3",

45 "bun-plugin-tailwind": "^0.1.2",

46 "class-variance-authority": "^0.7.1",

47 "clsx": "^2.1.1",

48 "jsonc-parser": "^3.3.1",

49 "lucide-react": "^1",

50 "radix-ui": "^1.6.7",

51 "react": "^19",

52 "react-dom": "^19",

53 "recharts": "^3.10.1",

54 "sonner": "^2.0.7",

55 "systray2": "^2.1.4",

56 "tailwind-merge": "^3.3.1",

57 "tailwindcss": "^4.1.11",

src/server/providers/qoder/cosy.tsView file

Lines 30-70typescript

30 QODER_MACHINE_OS,

31 QODER_MACHINE_TYPE,

32 QODER_RSA_PUBLIC_KEY,

33} from "./constants";

35export interface CosyCreds {

Source & flagged code

3 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code