registry / mewkit / 1.14.0

mewkit@1.14.0

MeowKit CLI — scaffold, upgrade, and manage your AI agent toolkit

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 319 file(s), 1.37 MB of source, external domains: 127.0.0.1, aistudio.google.com, ampcode.com, anthropic.com, api.github.com, block.github.io, brew.sh, codelabs.developers.google.com, developers.openai.com, docs.all-hands.dev, docs.anthropic.com, docs.cline.bot, docs.cursor.com, docs.factory.ai, docs.flutter.dev, docs.github.com, docs.openhands.dev, docs.roocode.com, docs.windsurf.com, evil.example.com, export.arxiv.org, ffmpeg.org, github.com, imagemagick.org, kilocode.ai, kiro.dev, meowkit.dev, opencode.ai, openrouter.ai, platform.minimax.io, playwright.dev, react.dev, www.w3.org

Source & flagged code

2 flagged

dist/memory/validate.jsView file

Lines 1-24javascript

1import fs from "node:fs";

2import path from "node:path";

3import { createRequire } from "node:module";

4import { CURATED_STORES } from "./schemas.js";

5const require = createRequire(import.meta.url);

6// Load the real validate-content.cjs (DRY — never reimplement the injection

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/validate.jsView on unpkg · L4

7// patterns) from the project that owns this memory dir. Absent → recheck skipped.

8export function loadContentValidator(memoryDir) {

9 const projectRoot = path.resolve(memoryDir, "..", "..");

10 const libPath = path.join(projectRoot, ".claude", "hooks", "lib", "validate-content.cjs");

11 if (!fs.existsSync(libPath))

12 return null;

13 try {

14 const mod = require(libPath);

15 return typeof mod.validateContent === "function" ? mod.validateContent : null;

16 }

17 catch {

18 return null;

19 }

20}

21// Count `## ` section headings in a topic MD file — proxy for entry count, used

22// only for the advisory MD↔JSON divergence warning.

23function countMdSections(mdPath) {

24 if (!fs.existsSync(mdPath))

dist/orchviz-web/fira-code-greek-500-normal.woff2View file

•path = dist/orchviz-web/fira-code-greek-500-normal.woff2 kind = high_entropy_blob sizeBytes = 7816 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/orchviz-web/fira-code-greek-500-normal.woff2View on unpkg

Source & flagged code

2 flagged · loading source

dist/memory/validate.jsView file

4import { CURATED_STORES } from "./schemas.js"; L5: const require = createRequire(import.meta.url); L6: // Load the real validate-content.cjs (DRY — never reimplement the injection

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/validate.jsView on unpkg · L4

dist/orchviz-web/fira-code-greek-500-normal.woff2View file

•path = dist/orchviz-web/fira-code-greek-500-normal.woff2 kind = high_entropy_blob sizeBytes = 7816 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/orchviz-web/fira-code-greek-500-normal.woff2View on unpkg

Findings

1 High4 Medium6 Low

HighShips High Entropy Blobdist/orchviz-web/fira-code-greek-500-normal.woff2

MediumDynamic Requiredist/memory/validate.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/memory/validate.jsView file

Lines 1-24javascript

1import fs from "node:fs";

2import path from "node:path";

3import { createRequire } from "node:module";

4import { CURATED_STORES } from "./schemas.js";

5const require = createRequire(import.meta.url);

6// Load the real validate-content.cjs (DRY — never reimplement the injection

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/validate.jsView on unpkg · L4

7// patterns) from the project that owns this memory dir. Absent → recheck skipped.

8export function loadContentValidator(memoryDir) {

9 const projectRoot = path.resolve(memoryDir, "..", "..");

10 const libPath = path.join(projectRoot, ".claude", "hooks", "lib", "validate-content.cjs");

11 if (!fs.existsSync(libPath))

12 return null;

13 try {

14 const mod = require(libPath);

15 return typeof mod.validateContent === "function" ? mod.validateContent : null;

16 }

17 catch {

18 return null;

19 }

20}

21// Count `## ` section headings in a topic MD file — proxy for entry count, used

22// only for the advisory MD↔JSON divergence warning.

23function countMdSections(mdPath) {

24 if (!fs.existsSync(mdPath))

dist/orchviz-web/fira-code-greek-500-normal.woff2View file

•path = dist/orchviz-web/fira-code-greek-500-normal.woff2 kind = high_entropy_blob sizeBytes = 7816 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/orchviz-web/fira-code-greek-500-normal.woff2View on unpkg