registry / linkgravity / 1.5.7

linkgravity@1.5.7

⚠ Under review

Discord/Telegram bot bridge for the Antigravity (agy) CLI, with voice interaction support

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 92.8 KB of source, external domains: 127.0.0.1, github.com, www.google.com

Source & flagged code

7 flagged

voice-service/stt.jsView file

Lines 1-25javascript

1const { spawn } = require('child_process');

2const ffmpegPath = require('ffmpeg-static');

4// Unofficial Google STT key - same default Python's SpeechRecognition (recognize_google) ships with.

5const GOOGLE_STT_KEY = 'AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw';

High

High Secret

Package contains a high-severity secret pattern.

voice-service/stt.jsView on unpkg · L5

High

Secret Pattern

Google API key in voice-service/stt.js

voice-service/stt.jsView on unpkg · L5

7function flacEncode(wavBuffer) {

8 return new Promise((resolve, reject) => {

9 const ff = spawn(ffmpegPath, [

10 '-hide_banner',

11 '-loglevel',

12 'error',

13 '-i',

14 'pipe:0',

15 '-f',

16 'flac',

17 'pipe:1',

18 ]);

19 const out = [];

20 ff.stdout.on('data', (d) => out.push(d));

21 ff.stderr.on('data', () => {}); // -loglevel error already keeps this quiet in the normal case

22 ff.on('error', (err) => reject(new Error(`ffmpeg-static failed to run (${err.message})`)));

23 ff.on('close', (code) => {

24 if (code !== 0) return reject(new Error(`ffmpeg exited with code ${code}`));

25 resolve(Buffer.concat(out));

•matchType = normalized_sha256 matchedPackage = linkgravity@1.5.3 matchedPath = voice-service/stt.js matchedIdentity = npm:bGlua2dyYXZpdHk:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

voice-service/stt.jsView on unpkg

npm-scripts/ensure-env.jsView file

Lines 1-21javascript

1'use strict';

2const { execSync } = require('child_process');

3const os = require('os');

High

Child Process

Package source references child process execution.

npm-scripts/ensure-env.jsView on unpkg · L1

bin/cli.jsView file

Lines 20-60javascript

20const cmd = process.argv[2];

22const color = {

23 reset: '\x1b[0m',

24 green: '\x1b[32m',

hooks/hook.pyView file

•path = hooks/hook.py kind = build_helper sizeBytes = 2343 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/hook.pyView on unpkg

Source & flagged code

7 flagged · loading source

voice-service/stt.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code