luzra-cli@0.2.6
⚠ Under review터미널 AI(Claude Code) 프롬프트 습관을 채점·코칭하는 리포트 — 세션 로그는 로컬에서만 분석됩니다.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedsrc/connect.jsView file
1// 디바이스 코드 페어링 — 토큰을 사람이 복사·전달할 필요가 없다.
L2: import { spawn } from "node:child_process";
L3: import { c, blank, info, ok, warn } from "./ui.js";
High
1// 디바이스 코드 페어링 — 토큰을 사람이 복사·전달할 필요가 없다.
L2: import { spawn } from "node:child_process";
L3: import { c, blank, info, ok, warn } from "./ui.js";
L4:
L5: export const DEFAULT_URL = "https://luzra.aimgonna.com";
L6:
...
L8: const cmd =
L9: process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
L10: : process.platform === "darwin" ? ["open", [url]]
...
L23: headers: { "Content-Type": "application/json" },
L24: body: JSON.stringify(body || {}),
L25: });
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/connect.jsView on unpkg · L1src/install.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = luzra-cli@0.2.3
matchedIdentity = npm:bHV6cmEtY2xp:0.2.3
similarity = 0.813
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical5 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/install.js
HighChild Processsrc/connect.js
HighShellsrc/install.js
HighSandbox Evasion Gated Capabilitysrc/connect.js
HighTrigger Reachable Persistencesrc/schedule.js
HighRuntime Package Installsrc/install.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/schedule.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to luzra-cli@0.2.6.
See all versions of luzra-cli for other recorded verdicts.
- Review the evidence and your use of luzra-cli@0.2.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.