registry / moodline / 0.3.20

moodline@0.3.20

Statusline divertida e informativa para CLIs de IA (Claude Code, GitHub Copilot CLI e mais): barra de contexto em gradiente, emoji-humor, git, custo e trocadilhos de dev.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 74.5 KB of source, external domains: 127.0.0.1, registry.npmjs.org

Source & flagged code

2 flagged

bin/moodline.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

2// moodline — instalador/CLI. Escopo de instalacao SEMPRE global (user-level).

3//

4// moodline init wizard interativo (logo animado + seletor de CLIs/features)

5// moodline enable [--all] liga a statusline (Claude Code / Copilot CLI)

6// moodline disable [--all] desliga (mantem config; re-enable instantaneo)

7// moodline doctor mostra estado

8// moodline uninstall [--purge] remove a statusLine (e o engine com --purge)

9// moodline render le JSON no stdin e imprime a barra (teste)

10// moodline watch [experimental] poller pro OpenCode

11// moodline --help|--version

13import { readFileSync, existsSync } from 'node:fs';

14import { spawnSync } from 'node:child_process';

15import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

16import { fileURLToPath } from 'node:url';

17import { render, ADAPTERS, attachGit, loadConfig, fromOpenCode, cmpVer } from '../lib/moodline-core.mjs';

18import * as ui from '../lib/ui.mjs';

19import { printLogo, smallLogo } from '../lib/logo.mjs';

20import * as install from '../lib/install.mjs';

21import { validatePackageName, sanitizeForLog } from '../lib/sanitize.mjs';

23const C = ui.C;

24const HERE = dirname(fileURLToPath(import.meta.url));

25const PKG = JSON.parse(readFileSync(join(HERE, '..', 'package.json'), 'utf8'));

27// ---- seguranca (validacao/sanitizacao centralizadas em ../lib/sanitize.mjs) ----

28const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;

30// Resolve o npm-cli.js por caminho ABSOLUTO a partir do node em execucao (process.execPath),

31// sem consultar o PATH. Cobre os layouts comuns (npm oficial no Windows e <prefix>/lib no POSIX/nvm).

32function npmCliPath() {

33 const exeDir = dirname(process.execPath);

34 const candidates = [

35 join(exeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'), // Windows: <node>\node_modules\npm

36 join(exeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'), // POSIX: <prefix>/lib/node_modules/npm

37 ];

38 return candidates.find((p) => existsSync(p)) || null;

39}

41// Instala um pacote global SEM shell e SEM depender do PATH: roda o `npm-cli.js` (resolvido por

42// caminho absoluto a partir do node atual) com o proprio `node` (process.execPath, absoluto).

43// `pkg` validado por allowlist ANTES do spawn. Sem fallback por PATH -> evita S4036/CWE-426/427

44// (um `npm` malicioso num diretorio gravavel do PATH nunca e executado). Cross-platform: usa o

45// npm que acompanha o Node em execucao.

46function installGlobal(pkg) {

47 const safe = validatePackageName(pkg);

48 const cli = npmCliPath();

49 if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline');

50 return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false });

51}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

53function parseArgs(argv) {

54 const o = { _: [] };

55 for (const a of argv) {

56 if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); o[k] = v === undefined ? true : v; }

57 else o._.push(a);

58 }

59 return o;

60}

62const ALL_FEATURES = ['git', 'cost', 'rate', 'puns'];

64async function cmdInit(opts) {

65 await printLogo({ animate: ui.isInteractive() && !opts['no-anim'] });

66 const home = opts.home;

67 const detected = install.detectInstalled(home);

68 const interactive = ui.isInteractive() && !opts.yes && !opts['no-input'];

Source & flagged code

2 flagged · loading source

bin/moodline.jsView file

13import { readFileSync, existsSync } from 'node:fs'; L14: import { spawnSync } from 'node:child_process'; L15: import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

48const cli = npmCliPath(); L49: if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline'); L50: return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false }); L51: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

Findings

3 High3 Medium4 Low

HighChild Processbin/moodline.js

HighShell

HighRuntime Package Installbin/moodline.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/moodline.jsView file

Lines 1-68javascript

1#!/usr/bin/env node

2// moodline — instalador/CLI. Escopo de instalacao SEMPRE global (user-level).

3//

4// moodline init wizard interativo (logo animado + seletor de CLIs/features)

5// moodline enable [--all] liga a statusline (Claude Code / Copilot CLI)

6// moodline disable [--all] desliga (mantem config; re-enable instantaneo)

7// moodline doctor mostra estado

8// moodline uninstall [--purge] remove a statusLine (e o engine com --purge)

9// moodline render le JSON no stdin e imprime a barra (teste)

10// moodline watch [experimental] poller pro OpenCode

11// moodline --help|--version

13import { readFileSync, existsSync } from 'node:fs';

14import { spawnSync } from 'node:child_process';

15import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

bin/moodline.jsView on unpkg · L13

16import { fileURLToPath } from 'node:url';

17import { render, ADAPTERS, attachGit, loadConfig, fromOpenCode, cmpVer } from '../lib/moodline-core.mjs';

18import * as ui from '../lib/ui.mjs';

19import { printLogo, smallLogo } from '../lib/logo.mjs';

20import * as install from '../lib/install.mjs';

21import { validatePackageName, sanitizeForLog } from '../lib/sanitize.mjs';

23const C = ui.C;

24const HERE = dirname(fileURLToPath(import.meta.url));

25const PKG = JSON.parse(readFileSync(join(HERE, '..', 'package.json'), 'utf8'));

27// ---- seguranca (validacao/sanitizacao centralizadas em ../lib/sanitize.mjs) ----

28const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;

30// Resolve o npm-cli.js por caminho ABSOLUTO a partir do node em execucao (process.execPath),

31// sem consultar o PATH. Cobre os layouts comuns (npm oficial no Windows e <prefix>/lib no POSIX/nvm).

32function npmCliPath() {

33 const exeDir = dirname(process.execPath);

34 const candidates = [

35 join(exeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'), // Windows: <node>\node_modules\npm

36 join(exeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'), // POSIX: <prefix>/lib/node_modules/npm

37 ];

38 return candidates.find((p) => existsSync(p)) || null;

39}

41// Instala um pacote global SEM shell e SEM depender do PATH: roda o `npm-cli.js` (resolvido por

42// caminho absoluto a partir do node atual) com o proprio `node` (process.execPath, absoluto).

43// `pkg` validado por allowlist ANTES do spawn. Sem fallback por PATH -> evita S4036/CWE-426/427

44// (um `npm` malicioso num diretorio gravavel do PATH nunca e executado). Cross-platform: usa o

45// npm que acompanha o Node em execucao.

46function installGlobal(pkg) {

47 const safe = validatePackageName(pkg);

48 const cli = npmCliPath();

49 if (!cli) throw new Error('npm não encontrado junto ao Node em execução — atualize manualmente: npm install -g moodline');

50 return spawnSync(process.execPath, [cli, 'install', '-g', safe], { stdio: 'ignore', shell: false });

51}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/moodline.jsView on unpkg · L48

53function parseArgs(argv) {

54 const o = { _: [] };

55 for (const a of argv) {

56 if (a.startsWith('--')) { const [k, v] = a.slice(2).split('='); o[k] = v === undefined ? true : v; }

57 else o._.push(a);

58 }

59 return o;

60}

62const ALL_FEATURES = ['git', 'cost', 'rate', 'puns'];

64async function cmdInit(opts) {

65 await printLogo({ animate: ui.isInteractive() && !opts['no-anim'] });

66 const home = opts.home;

67 const detected = install.detectInstalled(home);

68 const interactive = ui.isInteractive() && !opts.yes && !opts['no-input'];