registry / ltcai / 8.5.0

ltcai@8.5.0

Lattice AI — local-first Digital Brain that keeps your knowledge durable across any AI model.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 1.37 MB of source, external domains: 127.0.0.1, github.com, react.dev, reactflow.dev, www.w3.org

Source & flagged code

5 flagged

bin/ltcai.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require("node:child_process");

4const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/ltcai.jsView on unpkg · L2

5const fs = require("node:fs");

6const os = require("node:os");

7const path = require("node:path");

9const root = path.resolve(__dirname, "..");

10const managedVenv = process.env.LTCAI_NPM_VENV || path.join(os.homedir(), ".ltcai", "npm-python");

11const managedPython = process.platform === "win32"

12 ? path.join(managedVenv, "Scripts", "python.exe")

13 : path.join(managedVenv, "bin", "python");

15function loadDotEnv(file) {

16 if (!fs.existsSync(file)) return;

17 for (const rawLine of fs.readFileSync(file, "utf8").split(/\r?\n/)) {

18 const line = rawLine.trim();

19 if (!line || line.startsWith("#") || !line.includes("=")) continue;

20 const index = line.indexOf("=");

21 const key = line.slice(0, index).trim();

22 const value = line.slice(index + 1).trim().replace(/^["']|["']$/g, "");

scripts/run_integration_tests.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync } from "node:fs";

4import { join } from "node:path";

6const host = process.env.LTCAI_TEST_HOST || "127.0.0.1"

scripts/lint_frontend.mjsView file

Lines 11-51javascript

11function fail(message) {

12 failures += 1;

13 console.error(`FAIL ${message}`);

14}

16function walk(dir, exts) {

17 if

telegram_bot.pyView file

•path = telegram_bot.py kind = build_helper sizeBytes = 322 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

telegram_bot.pyView on unpkg

static/vendor/icons/tabler-icons.woff2View file

•path = static/vendor/icons/tabler-icons.woff2 kind = high_entropy_blob sizeBytes = 820316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/vendor/icons/tabler-icons.woff2View on unpkg

Source & flagged code

5 flagged · loading source

bin/ltcai.jsView file

2L3: const { spawn } = require("node:child_process"); L4: const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/ltcai.jsView on unpkg · L2

scripts/run_integration_tests.mjsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { existsSync } from "node:fs"; ... L5: L6: const host = process.env.LTCAI_TEST_HOST || "127.0.0.1"; L7: const port = process.env.LTCAI_TEST_PORT || "8899"; L8: const baseUrl = process.env.LTCAI_TEST_BASE_URL || `http://${host}:${port}`; L9: const venvPython = join(process.cwd(), ".venv", "bin", "python");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/run_integration_tests.mjsView on unpkg · L1

scripts/lint_frontend.mjsView file

31L32: const tsc = spawnSync("npx", ["tsc", "-p", "tsconfig.json", "--noEmit"], { cwd: repo, encoding: "utf8" }); L33: if (tsc.status !== 0) fail(`frontend typecheck\n${tsc.stdout}${tsc.stderr}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/lint_frontend.mjsView on unpkg · L31

telegram_bot.pyView file

•path = telegram_bot.py kind = build_helper sizeBytes = 322 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

telegram_bot.pyView on unpkg

static/vendor/icons/tabler-icons.woff2View file

•path = static/vendor/icons/tabler-icons.woff2 kind = high_entropy_blob sizeBytes = 820316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/vendor/icons/tabler-icons.woff2View on unpkg

Findings

5 High4 Medium5 Low

HighChild Processbin/ltcai.js

HighShell

HighSame File Env Network Executionscripts/run_integration_tests.mjs

HighRuntime Package Installscripts/lint_frontend.mjs

HighShips High Entropy Blobstatic/vendor/icons/tabler-icons.woff2

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertelegram_bot.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

bin/ltcai.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require("node:child_process");

4const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/ltcai.jsView on unpkg · L2

5const fs = require("node:fs");

6const os = require("node:os");

7const path = require("node:path");

9const root = path.resolve(__dirname, "..");

10const managedVenv = process.env.LTCAI_NPM_VENV || path.join(os.homedir(), ".ltcai", "npm-python");

11const managedPython = process.platform === "win32"

12 ? path.join(managedVenv, "Scripts", "python.exe")

13 : path.join(managedVenv, "bin", "python");

15function loadDotEnv(file) {

16 if (!fs.existsSync(file)) return;

17 for (const rawLine of fs.readFileSync(file, "utf8").split(/\r?\n/)) {

18 const line = rawLine.trim();

19 if (!line || line.startsWith("#") || !line.includes("=")) continue;

20 const index = line.indexOf("=");

21 const key = line.slice(0, index).trim();

22 const value = line.slice(index + 1).trim().replace(/^["']|["']$/g, "");

scripts/run_integration_tests.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { existsSync } from "node:fs";

4import { join } from "node:path";

6const host = process.env.LTCAI_TEST_HOST || "127.0.0.1"

scripts/lint_frontend.mjsView file

Lines 11-51javascript

11function fail(message) {

12 failures += 1;

13 console.error(`FAIL ${message}`);

14}

16function walk(dir, exts) {

17 if

telegram_bot.pyView file

•path = telegram_bot.py kind = build_helper sizeBytes = 322 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

telegram_bot.pyView on unpkg

static/vendor/icons/tabler-icons.woff2View file

•path = static/vendor/icons/tabler-icons.woff2 kind = high_entropy_blob sizeBytes = 820316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

static/vendor/icons/tabler-icons.woff2View on unpkg