registry / litcodex-ai / 0.3.41

litcodex-ai@0.3.41

Codex loop harness installer. Run `npx litcodex-ai install` to set up the LitCodex Codex platform: the bare `lit` hook and the durable lit-loop runtime.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 177 file(s), 582 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

5 flagged

package.jsonView file

Lines 27-55json

27 "litcodex": "bin/litcodex.js"

28 },

29 "files": [

30 "bin",

31 "dist",

32 "marketplace",

33 "model-catalog.json",

34 "README.md",

35 "LICENSE"

36 ],

37 "dependencies": {

38 "@litcodex/lit-loop": "0.3.41"

39 },

40 "bundledDependencies": [

41 "@litcodex/lit-loop"

42 ],

43 "scripts": {

44 "build": "tsc -p tsconfig.build.json",

45 "typecheck": "tsc --noEmit",

46 "test": "vitest --run",

47 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "prepack": "node ../../scripts/prepack-bundle-component.mjs",

49 "postpack": "node ../../scripts/postpack-clean-component.mjs"

50 },

51 "engines": {

52 "node": ">=20.0.0"

53 }

54}

marketplace/plugins/litcodex/skills/lit-scientific-visualization/references/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = [redacted]-scientific-[redacted]045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

marketplace/plugins/litcodex/skills/lit-scientific-visualization/references/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

•path = [redacted]-scientific-[redacted]045_scientific-visualization/tests/test_figure_export.py kind = build_helper sizeBytes = 1742 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

marketplace/plugins/litcodex/skills/lit-scientific-visualization/references/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

dist/install/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = litcodex-ai@0.3.38 matchedIdentity = npm:bGl0Y29kZXgtYWk:0.3.38 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code