registry / overtree / 0.1.1

overtree@0.1.1

OverTree is a local paper-writing workspace powered by AgInTi Cloud credits.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 1.76 MB of source, external domains: 127.0.0.1, api.deepseek.com, api.openai.com, api.overtree.top, api.venice.ai, bailian.console.aliyun.com, dashscope.aliyuncs.com, duckduckgo.com, example.com, flow.lazying.art, github.com, grsai.ai, grsaiapi.com, news.ycombinator.com, platform.deepseek.com, platform.openai.com, registry.npmjs.org, skills.flow.lazying.art, venice.ai

Source & flagged code

7 flagged

package.jsonView file

Lines 108-144json

108 "smoke:cli-chat": "node scripts/smoke-cli-chat.js",

109 "smoke:docker-command": "node scripts/smoke-docker-command.js",

110 "smoke:skills": "node scripts/smoke-skills.js",

111 "smoke:skillmesh": "node scripts/smoke-skillmesh.js",

112 "smoke:toolchain-docker": "node scripts/smoke-toolchain-docker.js",

113 "smoke:inbox": "node scripts/smoke-inbox.js",

114 "smoke:mcp": "node scripts/smoke-mcp.js",

115 "smoke:model-roles": "node scripts/smoke-model-roles.js",

116 "smoke:platform": "node scripts/smoke-platform.js",

117 "smoke:perception-research": "node scripts/smoke-perception-research.js",

118 "smoke:permission-modes": "node scripts/smoke-permission-modes.js",

119 "smoke:runtime-compat": "node scripts/smoke-runtime-compat.js",

120 "smoke:tmux-tools": "node scripts/smoke-tmux-tools.js",

121 "smoke:web-api": "node scripts/smoke-web-api.js",

122 "smoke:web-ui": "node scripts/smoke-web-ui.js",

123 "smoke:web-autostart": "node scripts/smoke-web-autostart.js",

124 "smoke:webapp-command": "node scripts/smoke-webapp-command.js",

125 "smoke:web-port-fallback": "node scripts/smoke-web-port-fallback.js",

126 "smoke:autoupdate": "node scripts/smoke-auto-update.js",

127 "real:deepseek": "node scripts/real-deepseek-capabilities.js",

128 "postinstall": "node scripts/postinstall-webapp.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L128

129 "supervision:seed": "node scripts/seed-supervised-homework.js",

130 "storage:migrate": "node bin/aginti-cli.js storage migrate",

131 "publish:env": "node scripts/npm-publish-from-env.js publish --access public",

132 "publish:env:whoami": "node scripts/npm-publish-from-env.js whoami",

133 "test": "npm run check && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:auth && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && np ...

134 "pack:dry-run": "npm pack --dry-run",

135 "smoke:capabilities": "node scripts/smoke-capabilities.js"

136 },

137 "dependencies": {

138 "@modelcontextprotocol/sdk": "^1.29.0",

139 "express": "^5.1.0",

140 "openai": "^6.3.0",

141 "playwright": "^1.55.0"

142 }

143}

144

Long lines were clipped for display.

scripts/smoke-web-api.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

scripts/smoke-web-api.jsView on unpkg · L1

4import os from "node:os";

src/agent-runner.jsView file

Lines 585-625javascript

585 {

586 role: "system",

587 content: [

588 "You are a careful browser and shell agent with a small tool surface.",

589 "Use only the provided tools.",

590 "The execution plan is not the final answer. After planning, actively use tools until the requested task is complete or genuinely blocked.",

src/skillmesh.jsView file

Lines 1-23javascript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import fsSync from "node:fs";

4import http from "node:http";

src/auto-update.jsView file

Lines 145-185javascript

145 if (raw === undefined || raw === "") return DEFAULT_CHECK_INTERVAL_MS;

146 const value = Number(raw);

147

references/run_design_scan.shView file

•path = references/run_design_scan.sh kind = build_helper sizeBytes = 2980 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

references/run_design_scan.shView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code