registry / oh-aicoding-tool / 0.1.75

oh-aicoding-tool@0.1.75

Configure AI coding tools with Langfuse tracing and install the oh-ai-report issue feedback plugin.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 32 file(s), 400 KB of source, external domains: 120.46.221.227, gitcode.com, metrics.openharmonyinsight.cn, nodejs.org, pypi.tuna.tsinghua.edu.cn, registry.npmjs.org, registry.npmmirror.com, www.python.org

Source & flagged code

8 flagged

bin/langfuse-cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from "fs";

3import path from "path";

4import readline from "readline";

5import { fileURLToPath } from "url";

Source & flagged code

8 flagged · loading source

bin/langfuse-cli.jsView file

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/langfuse-cli.jsView on unpkg · L5

149const r = isWindowsShellScript L150: ? spawnSync([command, ...args].join(" "), { encoding: "utf8", shell: true }) L151: : spawnSync(command, args, { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/langfuse-cli.jsView on unpkg · L149

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs"; ... L11: L12: const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn"; L13: const LEGACY_LANGFUSE_BASE_URLS = new Set([ ... L52: L53: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L54: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : ""); ... L108: function clearScreen() { L109: if (process.stdout.isTTY) process.stdout.write("\x1b[2J\x1b[H"); L110: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/langfuse-cli.jsView on unpkg · L5

scripts/skillhub/source.mjsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import crypto from "node:crypto"; ... L11: export function ensureSkillSourceRoot(manifest, options = {}) { L12: const env = options.env || process.env; L13: if (env.OH_SKILLHUB_SOURCE_DIR) { ... L22: L23: const cacheRoot = env.OH_SKILLHUB_CACHE_DIR || path.join(os.homedir(), ".oh-skillhub", "cache"); L24: const sparsePaths = selectedSparsePaths(options.skills); ... L190: const child = spawn("git", args, { shell: false }); L191: let stdout = ""; L192: let stderr = "";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/skillhub/source.mjsView on unpkg · L1

scripts/opencode-langfuse-setup.mjsView file

3import os from "node:os"; L4: import { spawn, spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L13: const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); L14: const packageJson = JSON.parse(fs.readFileSync(path.join(rootDir, "package.json"), "utf8")); L15: const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn"; L16: const LEGACY_LANGFUSE_BASE_URLS = new Set([ ... L64: L65: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L66: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : ""); ... L127: function writeLangfusePluginUserConfig({ userId }) { L128: const home = os.homedir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/opencode-langfuse-setup.mjsView on unpkg · L3

scripts/auto-update-runtime.mjsView file

3import readline from "node:readline"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L11: const ALLOWED_TARGETS = new Set(["claude", "opencode", "codex"]); L12: const OFFICIAL_NPM_REGISTRY = "https://registry.npmjs.org/"; L13: L14: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L15: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : "");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/auto-update-runtime.mjsView on unpkg · L3

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 60717 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg

opencode-ohai-report/scripts/real-self-verify.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = oh-aicoding-tool@0.1.72 matchedIdentity = npm:b2gtYWljb2RpbmctdG9vbA:0.1.72 similarity = 0.581 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

opencode-ohai-report/scripts/real-self-verify.mjsView on unpkg

Findings

5 High5 Medium6 Low

HighChild Processbin/langfuse-cli.js

HighShellbin/langfuse-cli.js

HighSame File Env Network Executionscripts/auto-update-runtime.mjs

HighSandbox Evasion Gated Capabilitybin/langfuse-cli.js

HighPrevious Version Dangerous Deltaopencode-ohai-report/scripts/real-self-verify.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/opencode-langfuse-setup.mjs

MediumShips Build Helpercodex_langfuse_notify.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoscripts/skillhub/source.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Lines 129-169javascript

129}

130

131function normalizeUserId(v) {

132 return String(v || "").trim();

133}

134

135function isValidUserId(v) {

136 return USER_ID_PATTERN.test(normalizeUserId(v));

137}

138

139function userIdValidationMessage() {

140 return `User ID must match ${USER_ID_PATTERN_TEXT}, for example h00613222 or hwx1234567.`;

141}

142

143function scriptPath(name) {

144 return path.join(scriptsDir, name);

145}

146

147function commandExists(command, args = ["--version"]) {

148 const isWindowsShellScript = process.platform === "win32" && /\.(cmd|bat)$/i.test(command);

149 const r = isWindowsShellScript

150 ? spawnSync([command, ...args].join(" "), { encoding: "utf8", shell: true })

151 : spawnSync(command, args, { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/langfuse-cli.jsView on unpkg · L149

152 return {

153 ok: !r.error && r.status === 0,

154 stdout: (r.stdout || "").trim(),

155 stderr: (r.stderr || "").trim()

156 };

157}

158

159function detectPython() {

160 const candidates = process.platform === "win32" ? ["python", "py"] : ["python3", "python"];

161 for (const cmd of candidates) {

162 const versionArgs = cmd === "py" ? ["-3", "--version"] : ["--version"];

163 const version = commandExists(cmd, versionArgs);

164 if (!version.ok) continue;

165 const pipArgs = cmd === "py" ? ["-3", "-m", "pip", "--version"] : ["-m", "pip", "--version"];

166 const pip = commandExists(cmd, pipArgs);

167 return { ok: true, command: cmd, version: version.stdout || version.stderr, pipOk: pip.ok, pipVersion: pip.stdout || pip.stderr };

168 }

169 return { ok: false, command: null, version: "", pipOk: false, pipVersion: "" };