registry / mr-sliy / 2.4.7

mr-sliy@2.4.7

Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 566 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.doubao.com, api.github.com, api.moonshot.cn, api.openai.com, dashscope.aliyuncs.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn

Source & flagged code

5 flagged

package.jsonView file

Lines 1-40json

2 "name": "mr-sliy",

3 "version": "2.4.7",

4 "description": "Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体",

5 "main": "src/agent.js",

6 "bin": {

7 "mr-sliy": "src/agent.js",

8 "sliy": "src/agent.js"

9 },

10 "files": [

11 "src/",

12 "database/schema.sql",

13 "database/init.js",

14 "database/seed.js",

15 "scripts/",

16 "data/knowledge-export.json",

17 ".env.example"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "start": "node src/agent.js",

22 "agent": "node src/agent.js",

23 "server": "node src/index.js",

24 "dev": "nodemon src/agent.js",

25 "test": "jest",

26 "test:coverage": "jest --coverage",

27 "lint": "eslint src/",

28 "init": "node database/init.js",

29 "seed": "node database/seed.js",

30 "setup": "npm run init && npm run seed",

31 "download-wasm": "node scripts/download-tree-sitter.js"

32 },

33 "keywords": [

34 "ast",

35 "code-analysis",

36 "tree-sitter",

37 "rag",

38 "code-optimization",

39 "ai",

40 "agent",

database/init.jsView file

Lines 1-25javascript

1/**

2 * 数据库初始化脚本

3 * 创建SQLite数据库和所有表结构

4 */

6const Database = require('better-sqlite3');

7const path = require

src/services/vector/knowledgeBase.jsView file

Lines 305-345javascript

305 const conditions = [];

306 const params = [];

307

308 if (type) {

309 conditions.push('content_type = ?');

src/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mr-sliy@2.4.5 matchedIdentity = npm:bXItc2xpeQ:2.4.5 similarity = 0.881 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

database/init.jsView file

5L6: const Database = require('better-sqlite3'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

database/init.jsView on unpkg · L5

Findings

2 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredatabase/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/services/vector/knowledgeBase.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings