registry / peerllm-host-cli / 2.6.0

peerllm-host-cli@2.6.0

Command-line PeerLLM host: serve decentralized AI compute from a headless machine.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 73 file(s), 470 KB of source, external domains: 127.0.0.1, api.peerllm.com, huggingface.co, nodejs.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/core/capacity.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { arch as osArch } from "node:os";

High

Child Process

Package source references child process execution.

dist/core/capacity.jsView on unpkg · L1

3import { promisify } from "node:util";

4import si from "systeminformation";

5import { sampleGpuUtilization } from "./gpu-stats.js";

6const execFileP = promisify(execFile);

7const NVIDIA_SMI_TIMEOUT_MS = 1500;

8const GRAPHICS_CACHE_TTL_MS = 5 * 60 * 1000;

9const isAppleSilicon = process.platform === "darwin" && osArch() === "arm64";

10// ---------------------------------------------------------------------------

11// Graphics cache — vendor/static VRAM rarely changes, and si.graphics() is the

12// expensive call. Live numbers (utilization, free VRAM) come from nvidia-smi /

13// the GPU sampler on each tick; the cache only supplies vendor + static totals.

14// ---------------------------------------------------------------------------

15let cachedGraphics;

16let graphicsInFlight;

17async function getCachedGraphics() {

18 const now = Date.now();

19 if (cachedGraphics && now - cachedGraphics.ts < GRAPHICS_CACHE_TTL_MS) {

20 return cachedGraphics.data;

21 }

dist/core/orchestrator.jsView file

Lines 905-949javascript

905 stopTimers() {

906 if (this.heartbeatInterval) {

907 clearInterval(this.heartbeatInterval);

908 this.heartbeatInterval = null;

909 }

dist/core/paths.jsView file

Lines 1-24javascript

1import { createHash } from "node:crypto";

2import { homedir, platform, userInfo } from "node:os";

3import { join, resolve } from "node:path";

4function platformConfigDir() {

templates/windows/install-service.ps1View file

•path = templates/windows/install-service.ps1 kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/windows/install-service.ps1View on unpkg

Source & flagged code

5 flagged · loading source

dist/core/capacity.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code