registry / micro-models-agent / 0.2.38

micro-models-agent@0.2.38

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 77 file(s), 350 KB of source, external domains: api.together.xyz, example.com, huggingface.co, lite.duckduckgo.com

Source & flagged code

3 flagged

dist/ui/opentui-renderer.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { formatStatusLine } from './components/status-bar.js';

High

Child Process

Package source references child process execution.

dist/ui/opentui-renderer.jsView on unpkg · L1

3import { DoublePressDetector } from './double-press.js';

4let _Text;

5let _Box;

6let _TextareaRenderable;

7let _ScrollBox;

8let _MarkdownRenderable;

9let _SyntaxStyle;

10async function loadOpentui() {

11 const mod = await import('@opentui/core');

12 _Text = mod.Text;

13 _Box = mod.Box;

14 _TextareaRenderable = mod.TextareaRenderable;

15 _ScrollBox = mod.ScrollBox;

16 _MarkdownRenderable = mod.MarkdownRenderable;

17 _SyntaxStyle = mod.SyntaxStyle;

18 return mod;

19}

20const theme = {

21 bg: '#1a1b26',

dist/tools/bash.jsView file

Lines 1-21javascript

1import { execa, ExecaError } from 'execa';

2import { writeFileSync, existsSync, mkdirSync } from 'node:fs';

High

Shell

Package source references shell execution.

dist/tools/bash.jsView on unpkg · L1

3import { join } from 'node:path';

4import

dist/tools/syntax-check.jsView file

Lines 1-32javascript

1import { execSync } from 'node:child_process';

2import { readFileSync, existsSync } from 'node:fs';

3import { join } from 'node:path';

4import { createRequire } from 'node:module';

Source & flagged code

3 flagged · loading source

dist/ui/opentui-renderer.jsView file

1import { execSync } from 'node:child_process'; L2: import { formatStatusLine } from './components/status-bar.js';

High

Child Process

Package source references child process execution.

dist/ui/opentui-renderer.jsView on unpkg · L1

dist/tools/bash.jsView file

1import { execa, ExecaError } from 'execa'; L2: import { writeFileSync, existsSync, mkdirSync } from 'node:fs';

High

Shell

Package source references shell execution.

dist/tools/bash.jsView on unpkg · L1

dist/tools/syntax-check.jsView file

12try { L13: execSync(`npx tsc --noEmit --pretty false "${fullPath}"`, { L14: encoding: 'utf-8',

Findings

3 High3 Medium6 Low

HighChild Processdist/ui/opentui-renderer.js

HighShelldist/tools/bash.js

HighRuntime Package Installdist/tools/syntax-check.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License