registry / mr-sliy / 2.7.8

mr-sliy@2.7.8

Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体

Static Scan Results

scanned 22h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 283 file(s), 2.85 MB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.doubao.com, api.github.com, api.moonshot.cn, api.openai.com, dashscope.aliyuncs.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn

Source & flagged code

5 flagged

package.jsonView file

Lines 2-42json

2 "name": "mr-sliy",

3 "version": "2.7.8",

4 "description": "Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体",

5 "main": "src/agent.js",

6 "bin": {

7 "mr-sliy": "src/agent.js",

8 "sliy": "src/agent.js"

9 },

10 "files": [

11 "README.md",

12 "LICENSE",

13 "src/",

14 "database/schema.sql",

15 "database/init.js",

16 "database/seed.js",

17 "scripts/",

18 "data/knowledge-export.json",

19 ".env.example"

20 ],

21 "scripts": {

22 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "start": "node src/agent.js",

24 "agent": "node src/agent.js",

25 "server": "node src/index.js",

26 "dev": "nodemon src/agent.js",

27 "test": "jest",

28 "test:coverage": "jest --coverage",

29 "lint": "eslint src/",

30 "init": "node database/init.js",

31 "seed": "node database/seed.js",

32 "setup": "npm run init && npm run seed",

33 "download-wasm": "node scripts/download-tree-sitter.js"

34 },

35 "keywords": [

36 "ast",

37 "code-analysis",

38 "tree-sitter",

39 "rag",

40 "code-optimization",

41 "ai",

42 "agent",

database/init.jsView file

Lines 1-25javascript

1/**

2 * 数据库初始化脚本

3 * 创建SQLite数据库和所有表结构

4 */

6const Database = require('better-sqlite3');

7const path = require

src/backups/update/2c2dc0d1-a00e-4dc9-ae91-9892df86dd54/services/vector/knowledgeBase.jsView file

Lines 305-345javascript

305 const conditions = [];

306 const params = [];

307

308 if (type) {

309 conditions.push(

src/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mr-sliy@2.7.5 matchedIdentity = npm:bXItc2xpeQ:2.7.5 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

database/init.jsView file

5L6: const Database = require('better-sqlite3'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

database/init.jsView on unpkg · L5

Findings

2 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredatabase/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/backups/update/2c2dc0d1-a00e-4dc9-ae91-9892df86dd54/services/vector/knowledgeBase.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings