registry / neuro-cli / 5.0.0

neuro-cli@5.0.0

Advanced AI-powered terminal coding assistant with multi-agent orchestration, sub-agent spawning, ACP protocol, OS-level sandboxing, spec-driven development, smart monitoring, multi-model routing, MCP Apps, auto-updater, and 23+ free models

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 1.90 MB of source, external domains: 127.0.0.1, api.duckduckgo.com, api.github.com, cwe.mitre.org, github.com, neurocli.dev, openrouter.ai, raw.githubusercontent.com, registry.agentskills.io, registry.npmjs.org

Source & flagged code

7 flagged

package.jsonView file

Lines 3-43json

3 "version": "5.0.0",

4 "description": "Advanced AI-powered terminal coding assistant with multi-agent orchestration, sub-agent spawning, ACP protocol, OS-level sandboxing, spec-driven development, smart monitoring, multi-model routing, MCP Apps, auto-updater, and 23+ free models",

5 "main": "dist/index.js",

6 "bin": {

7 "neuro": "dist/index.js"

8 },

9 "type": "module",

10 "files": [

11 "dist/**/*.js",

12 "dist/**/*.d.ts",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "build": "tsc",

18 "dev": "tsx src/index.ts",

19 "start": "node dist/index.js",

20 "lint": "eslint src/",

21 "clean": "rm -rf dist/",

22 "prepublishOnly": "npm run build",

23 "postinstall": "node -e \"console.log('\\n Thanks for installing NeuroCLI! Run \\'neuro\\' to get started.\\n')\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "keywords": [

26 "ai",

27 "cli",

28 "coding",

29 "assistant",

30 "openrouter",

31 "agent",

32 "multi-agent",

33 "llm",

34 "terminal",

35 "chatgpt",

36 "copilot",

37 "code-assistant",

38 "mcp",

39 "spec-driven",

40 "sandbox"

41 ],

42 "author": "Muhammed Turan <muhammedturan65>",

43 "license": "MIT",

dist/context/custom-tools.jsView file

Lines 276-316javascript

276 /**

277 * Attempt to extract a tool definition object from source code text.

278 * Looks for common export patterns and parses the object literal.

279 */

280 extractDefinitionFromSource(source, filePath) {

281 // Try to find: export const toolDefinition = { ... }

282 // or: export default { ... }

283 const

dist/context/git-checkpoint.jsView file

Lines 184-224javascript

184 if (!existsSync(gitDir)) {

185 try {

186 execSync('git init', { cwd: this.shadowRepo, encoding: 'utf-8' });

187 }

188 catch { }

dist/tools/browser.jsView file

Lines 1-25javascript

1// ============================================================

2// NeuroCLI - Browser Automation Tool

3// Headless Chrome control via Chrome DevTools Protocol

4// Fallback: curl-based HTTP requests when no browser available

5// ============================================================

6import { spawn, execSync } from 'child_process';

7import { existsSync, mkdirSync, writeFileSync } from 'fs';

dist/core/shell-completion.jsView file

Lines 23-63javascript

23 return this.generateBash();

24 case 'zsh':

25 return this.generateZsh();

26 case 'fish':

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = neuro-cli@4.1.2 matchedIdentity = npm:bmV1cm8tY2xp:4.1.2 similarity = 0.895 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code