registry / kodingo-cli / 1.0.31

kodingo-cli@1.0.31

Kodingo CLI

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 177 KB of source, external domains: kodingo-api.onrender.com, kodingo.xyz

Source & flagged code

3 flagged

dist/adapters/db-adapter/memory-persistence.jsView file

Lines 1-34javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.initDb = initDb;

4exports.checkDatabaseConnection = checkDatabaseConnection;

5exports.saveMemory = saveMemory;

6exports.getMemoryById = getMemoryById;

7exports.updateMemoryLifecycle = updateMemoryLifecycle;

8exports.suppressProposedSiblings = suppressProposedSiblings;

9exports.getMemoryByExternalId = getMemoryByExternalId;

10exports.getProposedOrIgnoredRecordBySymbol = getProposedOrIgnoredRecordBySymbol;

11exports.updateMemoryConfidence = updateMemoryConfidence;

12exports.deleteMemoryById = deleteMemoryById;

13exports.queryMemory = queryMemory;

14exports.queryMemoryBySymbol = queryMemoryBySymbol;

15const node_child_process_1 = require("node:child_process");

16const node_util_1 = require("node:util");

High

Child Process

Package source references child process execution.

dist/adapters/db-adapter/memory-persistence.jsView on unpkg · L14

17const uuid_1 = require("uuid");

18const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);

19async function initDb() {

20 await runPsql(`

21 CREATE TABLE IF NOT EXISTS kodingo_memory (

22 id uuid PRIMARY KEY,

23 type text NOT NULL,

24 title text NULL,

25 content text NOT NULL,

26 tags text[] NULL,

27 repo_path text NULL,

29 status text NOT NULL DEFAULT 'proposed',

30 confidence double precision NOT NULL DEFAULT 0.30,

31 symbol text NULL,

33 external_id text NULL,

dist/commands/scan-repo.jsView file

Lines 37-77javascript

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if

dist/commands/update.jsView file

Lines 7-36javascript

7 let currentVersion;

8 let latestVersion;

9 try {

10 currentVersion = (0, child_process_1.execSync)("kodingo --version", { encoding: "utf-8" }).trim();

11 }

12 catch {

13 currentVersion =

Source & flagged code

3 flagged · loading source

dist/adapters/db-adapter/memory-persistence.jsView file

14exports.queryMemoryBySymbol = queryMemoryBySymbol; L15: const node_child_process_1 = require("node:child_process"); L16: const node_util_1 = require("node:util");

High

Child Process

Package source references child process execution.

dist/adapters/db-adapter/memory-persistence.jsView on unpkg · L14

dist/commands/scan-repo.jsView file

57const ast_parser_1 = require("../utils/ast-parser"); L58: const API_BASE = "https://kodingo-api.onrender.com"; L59: const SUPPORTED_EXTENSIONS = [ ... L124: break; L125: const data = await res.json(); L126: for (const m of data.memories ?? []) { ... L146: headers: { "Content-Type": "application/json", "X-Kodingo-Token": token }, L147: body: JSON.stringify({ symbol: symbol.name, code: symbol.code }), L148: }); ... L164: machineId: (0, persistence_config_1.readConfig)().machineId ?? undefined, L165: displayName: os.hostname(), L166: fingerprint: symbol.fingerprint ?? undefined,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/scan-repo.jsView on unpkg · L57

dist/commands/update.jsView file

27try { L28: (0, child_process_1.execSync)("npm install -g kodingo-cli@latest", { stdio: "inherit" }); L29: console.log(`Updated to ${latestVersion} successfully.`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L27

Findings

3 High3 Medium5 Low

HighChild Processdist/adapters/db-adapter/memory-persistence.js

HighHost Fingerprint Exfiltrationdist/commands/scan-repo.js

HighRuntime Package Installdist/commands/update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/adapters/db-adapter/memory-persistence.jsView file

Lines 1-34javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.initDb = initDb;

4exports.checkDatabaseConnection = checkDatabaseConnection;

5exports.saveMemory = saveMemory;

6exports.getMemoryById = getMemoryById;

7exports.updateMemoryLifecycle = updateMemoryLifecycle;

8exports.suppressProposedSiblings = suppressProposedSiblings;

9exports.getMemoryByExternalId = getMemoryByExternalId;

10exports.getProposedOrIgnoredRecordBySymbol = getProposedOrIgnoredRecordBySymbol;

11exports.updateMemoryConfidence = updateMemoryConfidence;

12exports.deleteMemoryById = deleteMemoryById;

13exports.queryMemory = queryMemory;

14exports.queryMemoryBySymbol = queryMemoryBySymbol;

15const node_child_process_1 = require("node:child_process");

16const node_util_1 = require("node:util");

High

Child Process

Package source references child process execution.

dist/adapters/db-adapter/memory-persistence.jsView on unpkg · L14

17const uuid_1 = require("uuid");

18const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);

19async function initDb() {

20 await runPsql(`

21 CREATE TABLE IF NOT EXISTS kodingo_memory (

22 id uuid PRIMARY KEY,

23 type text NOT NULL,

24 title text NULL,

25 content text NOT NULL,

26 tags text[] NULL,

27 repo_path text NULL,

29 status text NOT NULL DEFAULT 'proposed',

30 confidence double precision NOT NULL DEFAULT 0.30,

31 symbol text NULL,

33 external_id text NULL,

dist/commands/scan-repo.jsView file

Lines 37-77javascript

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if

dist/commands/update.jsView file

Lines 7-36javascript

7 let currentVersion;

8 let latestVersion;

9 try {

10 currentVersion = (0, child_process_1.execSync)("kodingo --version", { encoding: "utf-8" }).trim();

11 }

12 catch {

13 currentVersion =